chkrootkit의 결과 lkm이 설치되었다고 하는데..

Checking `lkm'... You have     2 process hidden for readdir command
You have    11 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed

chrootkit를 돌리면 위와 같습니다.

게시글을 검색해 보고 다시 책을 보았는데 이게 LKM trojan이 설치된 것인지 모르겠기에 질문드립니다.

./chkproc -v 를 한 결과에서도  ? process hidden이 나옵니다.

몇번을 다시 ./chkproc -v를 해도 process hidden.. 이 나오는데, 나올때마다 pid는 다르지만 계속 검출됩니다.

히든 프로세스라고 나오는것을 보면 아래와 같습니다.

[chkrootkit-0.47]# ls -lha /proc/27228
합계 0
dr-xr-xr-x    3 mysql    mysql           0 11월  1 04:44 .
dr-xr-xr-x   59 root     root            0 10월 16 04:27 ..
-r--r--r--    1 root     root            0 11월  1 04:44 cmdline
lrwxrwxrwx    1 root     root            0 11월  1 04:44 cwd -> /usr/local/mysql/data
-r--------    1 root     root            0 11월  1 04:44 environ
lrwxrwxrwx    1 root     root            0 11월  1 04:44 exe -> /usr/local/mysql/libexec/mysqld
dr-x------    2 root     root            0 11월  1 04:44 fd
-r--r--r--    1 root     root            0 11월  1 04:44 maps
-rw-------    1 root     root            0 11월  1 04:44 mem
-r--r--r--    1 root     root            0 11월  1 04:44 mounts
lrwxrwxrwx    1 root     root            0 11월  1 04:44 root -> /
-r--r--r--    1 root     root            0 11월  1 04:44 stat
-r--r--r--    1 root     root            0 11월  1 04:44 statm
-r--r--r--    1 root     root            0 11월  1 04:44 status

mysql을 shutdown 하고 다시 검사하면 chkrootkit에서 hidden프로세스가 없다고 나옵니다.

그런데, rkhunter이나 rootcheck에서는 lkm부분에서 깨끗하게 나옵니다.(rkhunter을 돌리고 화면을 유심히 보았는데 * lkm 관련 부분은 not found로 나오는데, chkrootkit는 단순히 lkm trojan installed라고 나오니 잘 모르겠습니다. 

Checking for rootkits...

  Performing check of known rootkit files and directories
    55808 Trojan - Variant A                           [ Not found ]
    ADM Worm                                               [ Not found ]
    AjaKit Rootkit                                            [ Not found ]
    aPa Kit                                                       [ Not found ]
    Apache Worm                                            [ Not found ]
    Ambient (ark) Rootkit                                 [ Not found ]
    Balaur Rootkit                                            [ Not found ]
    BeastKit Rootkit                                         [ Not found ]
    beX2 Rootkit                                              [ Not found ]
    BOBKit Rootkit                                          [ Not found ]
    CiNIK Worm (Slapper.B variant)                [ Not found ]
    Danny-Boy's Abuse Kit                               [ Not found ]
    Devil RootKit                                              [ Not found ]
    Dica-Kit Rootkit                                         [ Not found ]
    Dreams Rootkit                                           [ Not found ]
    Duarawkz Rootkit                                       [ Not found ]
    Enye LKM                                                 [ Not found ]
    Flea Linux Rootkit                                       [ Not found ]
    FreeBSD Rootkit                                        [ Not found ]
    Fuck`it Rootkit                                            [ Not found ]
    GasKit Rootkit                                            [ Not found ]
    Heroin LKM                                               [ Not found ]
    HjC Kit                                                       [ Not found ]
    ignoKit Rootkit                                            [ Not found ]
    ImperalsS-FBRK Rootkit                            [ Not found ]
    Irix Rootkit                                                  [ Not found ]
    Kitko Rootkit                                               [ Not found ]
    Knark Rootkit                                              [ Not found ]
    Li0n Worm                                                  [ Not found ]
    Lockit / LJK2 Rootkit                                  [ Not found ]
    Mood-NT Rootkit                                       [ Not found ]
    MRK Rootkit                                              [ Not found ]
    Ni0 Rootkit                                                 [ Not found ]
    Ohhara Rootkit                                           [ Not found ]
    Optic Kit (Tux) Worm                                 [ Not found ]
    Oz Rootkit                                                  [ Not found ]
    Phalanx Rootkit                                           [ Not found ]
    Phalanx Rootkit (strings)                              [ Not found ]
    Portacelo Rootkit                                        [ Not found ]
    R3dstorm Toolkit                                         [ Not found ]
    RH-Sharpe's Rootkit                                    [ Not found ]
    RSHA's Rootkit                                           [ Not found ]
    Scalper Worm                                             [ Not found ]
    Sebek LKM                                                [ Not found ]
    Shutdown Rootkit                                        [ Not found ]
    SHV4 Rootkit                                              [ Not found ]
    SHV5 Rootkit                                              [ Not found ]
    Sin Rootkit                                                   [ Not found ]
    Slapper Worm                                              [ Not found ]
    Sneakin Rootkit                                            [ Not found ]
    Suckit Rootkit                                               [ Not found ]
    SunOS Rootkit                                              [ Not found ]
    SunOS / NSDAP Rootkit                              [ Not found ]
    Superkit Rootkit                                            [ Not found ]
    TBD (Telnet BackDoor)                                [ Not found ]
    TeLeKiT Rootkit                                           [ Not found ]
    T0rn Rootkit                                                  [ Not found ]
    Trojanit Kit                                                    [ Not found ]
    Tuxtendo Rootkit                                           [ Not found ]
    URK Rootkit                                                 [ Not found ]
    VcKit Rootkit                                                [ Not found ]
    Volc Rootkit                                                  [ Not found ]
    X-Org SunOS Rootkit                                   [ Not found ]
    zaRwT.KiT Rootkit                                        [ Not found ]

이게 정말 해킹을 당해 chkrootkit에서 lkm을 잘 잡아내고 있는 것인지, 아니면 chkrootkit이 잘못 잡고 있는 것인지 궁금합니다.