[Savannah-hackers] Re: [savannah-root] Suckit rootkit detected on subversions.gnu.org

[Vincent Caron]

Vincent Caron wrote:
> I don't have much more info for now, besides I can't see unexpected 
> processes listening on unexpected ports.

I have a little more actually :

* tke 'sk' process has been running since nov. 2

* its file was found in /usr/lib/locale/en_US/.sk12/sk
  (a copy is at http://zerodeux.net/misc/sk)

* running through /root/.bash_history does not show useful information

* I've straced the 'sk' process a little before killing it (see /root)