[윤동만]님이 남기신 글:

>ROOTDIR is `/' 
>Checking `amd'... Not vulnerable 
>Checking `basename'... Not vulnerable 
>Checking `biff'... Not vulnerable 
>Checking `chfn'... Not vulnerable 
>Checking `chsh'... Not vulnerable 
>Checking `cron'... Not vulnerable 
>Checking `date'... Not vulnerable 
>Checking `du'... Not vulnerable 
>Checking `dirname'... Not vulnerable 
>Checking `echo'... Not vulnerable 
>Checking `egrep'... Not vulnerable 
>Checking `env'... Not vulnerable 
>Checking `find'... Not vulnerable 
>Checking `fingerd'... Not vulnerable 
>Checking `gpm'... Not vulnerable 
>Checking `grep'... Not vulnerable 
>Checking `su'... Not vulnerable 
>Checking `ifconfig'... Not vulnerable 
>Checking `inetd'... Not vulnerable 
>Checking `identd'... Not vulnerable 
>Checking `killall'... Not vulnerable 
>Checking `login'... Not vulnerable 
>Checking `ls'... Not vulnerable 
>Checking `mail'... Not vulnerable 
>Checking `mingetty'... Not vulnerable 
>Checking `netstat'... Not vulnerable 
>Checking `named'... Not vulnerable 
>Checking `passwd'... Not vulnerable 
>Checking `pidof'... Not vulnerable 
>Checking `pop2'... NOT TESTED 
>Checking `pop3'... NOT TESTED 
>Checking `ps'... Not vulnerable 
>Checking `pstree'... Not vulnerable 
>Checking `rpcinfo'... Not vulnerable 
>Checking `rlogind'... Not vulnerable 
>Checking `rshd'... Not vulnerable 
>Checking `slogin'... NOT TESTED 
>Checking `sendmail'... Not vulnerable 
>Checking `sshd'... Not vulnerable 
>Checking `syslogd'... Not vulnerable 
>Checking `tar'... Not vulnerable 
>Checking `tcpd'... Not vulnerable 
>Checking `top'... Not vulnerable 
>Checking `telnetd'... Not vulnerable 
>Checking `timed'... Not vulnerable 
>Checking `traceroute'... Not vulnerable 
>Checking `write'... Not vulnerable 
>Checking `asp'... Not vulnerable 
>Checking `bindshell'... Not vulnerable 
>Checking `z2'... Checking `wted'... Nothing deleted 
>Checking `rexedcs'... Not vulnerable 
>Checking `sniffer'... 
>eth0 is not promisc 
>Checking `aliens'... No suspect files 
>Searching for sniffer's logs, it may take a while... Nothing found 
>Searching for t0rn's default files and dirs... Nothing found 
>Searching for t0rn's v8 defaults... Possible t0rn v8 (or variation) rootkit
installed 
>Searching for Lion Worm default files and dirs... Nothing found 
>Searching for RSHA's default files and dir... Nothing found 
>Searching for RH-Sharpe's default files... Nothing found 
>Searching for Ambient's rootkit (ark) default files and dirs... Nothing found

>Searching for suspicious files and dirs, it may take a while... 
>/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Image/Magick/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist
/usr/lib/perl5/5.00503/i386-linux/.packlist
/usr/lib/linuxconf/install/gnome/.directory /usr/lib/linuxconf/install/gnome/.order
/usr/man/man1/panz/psybnc/tools/.chk /lib/modules/2.2.16-3/.rhkmvtag 
>
>Searching for LPD Worm files and dirs... Nothing found 
>Searching for Ramen Worm files and dirs... Nothing found 
>Searching for Maniac files and dirs... Nothing found 
>Searching for RK17 files and dirs... Nothing found 
>Searching for Adore Worm... Nothing found 
>Searching for ShitC Worm... Nothing found 
>Searching for Omega Worm... Nothing found 
>Searching for anomalies in shell history files... Warning:
`//root/.gnome-desktop/홈
 디렉토리 
>//root/.gnome-desktop/cdrom 
>//root/.gnome-desktop/fd0' is linked to another file 
>Checking `lkm'... You have 1 process hidden for readdir command 
>You have 1 process hidden for ps command 
>Warning: Possible LKM Trojan installed 
>
>안녕하세요 
>전 레드헷6,2에 커널은 Kernel 2.2.16-3 버젼인데 아무래도
해킹당한것 
>같아서 이렇게 루트킷을 돌려보았습니다.
 
>이렇게 돌리는게 맞는지도 잘 모르는 초보입니다. 
>여하튼 돌려보니 이렇게 메세지가 나오는데 제가 무슨말인지
잘 몰라서. 
>이것 해킹당한것 맞죠 
>명령어도 이것저것 (예를들어 top 도 setuid) 로 되어있고
안되는명령어도
 
>있고 해서... 
>죄송하지만 루트킷돌린결과가
 이렇게 나왔고 이것이 무엇을 의미하는지 좀 
>가르쳐 주십시요. 
>좋은날들 되십시요... 

========================================

답변이 너무 늦었군요.

일단 

xxx Nothing found 
xxx vulnerable 
xxx NOT TESTED 
xxx Nothing detected

이런 메시지는 이상없다는 의미입니다.

다만,

>Checking `lkm'... You have 1 process hidden for readdir command 
>You have 1 process hidden for ps command 
>Warning: Possible LKM Trojan installed 

이 메시지가 의심이 나는군요..

Checking `lkm'... Nothing detected

이렇게 나와야 이상이 없다는 것인데...

시스템이 크랙킹 당했다고 생각이 조금이라도 든다면
시스템을 다시 설치하시길 바랍니다.

제가 봐서는 다시설치해야할것
 같군요...

답변이 늦어서 죄송합니다.