[clamav-users] Unix.Trojan.ElkKnot FOUND

DUCARROZ Birgit birgit.ducarroz at unifr.ch
Wed May 28 07:57:19 UTC 2014 

Thank you very much, that's nice.
Very happy about that :)

Regards,
Birgit


On 27. 05. 14 15:08 , Alain Zidouemba wrote:
> The samples for which you sent us the hashes appear to be benign.
>
> - Alain
>
>
> On Tue, May 27, 2014 at 4:25 AM, DUCARROZ Birgit
> <birgit.ducarroz at unifr.ch>wrote:
>
>> Hello,
>>
>> Is someone actually able to tell me if the list I submitted are false
>> positives or real trojans?
>>
>> Thank you,
>> Birgit
>>
>>
>>
>> On 23. 05. 14 15:28 , Alain Zidouemba wrote:
>>
>>> Thanks Birgit.
>>>
>>> - Alain
>>>
>>>
>>> On Fri, May 23, 2014 at 5:38 AM, DUCARROZ Birgit
>>> <birgit.ducarroz at unifr.ch>wrote:
>>>
>>>   oki. Here are the md5s of the most of the alerts:
>>>>
>>>> f4b3cda094eb5c4c1ab0ce2ee53e0e5f
>>>> eb693fd5c83093ec70845f2ae111edd9
>>>> 1c9b1eaef2cc4c55c05b2d0a4cc9d3da
>>>> fc04088eb26044a4a6f14e257152ee31
>>>> 77cb6047daab16e9227204fb0a141394
>>>> 2298d177a5a8e36bedfc84a230b96108
>>>> 77cb6047daab16e9227204fb0a141394
>>>> 77cb6047daab16e9227204fb0a141394
>>>> 77cb6047daab16e9227204fb0a141394
>>>> 77cb6047daab16e9227204fb0a141394
>>>> e32fef846556b7d2455a11835f50cb03
>>>> 47cfe14d7b665f5324b94c412944a0e5
>>>> 119db26d3cfbf660bef53f875a6196df
>>>> 5a2210d0f9cbc3a0db01cfecd51364f8
>>>> 5a2210d0f9cbc3a0db01cfecd51364f8
>>>> 5a2210d0f9cbc3a0db01cfecd51364f8
>>>> 5a2210d0f9cbc3a0db01cfecd51364f8
>>>> b47d4f505ba200a216d6bb5897603c06
>>>> 4a4fef9bee6ef51cc9de56c9fbb7c5fc
>>>> 8e6a199817effd7de20346d0bd13170e
>>>> a9b5c8216132bc64438f22a36cd09b7a
>>>> 87ac4ccf6aa33b8fbfb80aee72619480
>>>> aa0b165e01d243ce43810b5cb6c473ac
>>>> 8ad68b23b3e4c71f82eab9b6ffc07158
>>>> da63135571397425b14487d88d7a9d6e
>>>> db8f68512eea8922527cdbba73740774
>>>> 5297cf87b3569dc8f577a9aaba26446c
>>>> 3990511372761ec38a1c8ccffb9d37ca
>>>> 681b7cc1afedf142dae47ef67c98c332
>>>> 414002dc88dc0a3f653047d25ca49fbe
>>>> baa9976c323133b9638afbceb7affe81
>>>> fc6df0c9107d38fbb374ea8ece6de9fc
>>>> 1b55ee9724f26277fcbc5a5cedab63e5
>>>> c3193eb5e383ffe3b4cb34f9a82b6d91
>>>> a590277f1cde6ff4c58dbc5682af0680
>>>> db5a2e1d49bf5a58f0d52e19957ce764
>>>> 266c6c8c2e13ed19fb34e8f8388352c4
>>>> ffb6beb18b1f6b3955a59ad30c3928c5
>>>> 4a0ffb5cdf684de730f2404b7be83757
>>>> 3b33768d83da59ed83490d6d1f1e3e92
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> bc738b31483e8b6be0a7a043045a011e
>>>> 8917f23ea6169b7e54f5d7569e2184b7
>>>> 813de8d05d1a5a20ffdc61d961b4e000
>>>> 038fee0e92aec9ce86a7d7caf59a500c
>>>> fc04088eb26044a4a6f14e257152ee31
>>>> fc04088eb26044a4a6f14e257152ee31
>>>> 2524d60ef6d2ef87c8fd7e31ec723bef
>>>> 346a15c88a439820736c0519d3ff39e0
>>>> 7a23cde62d14667a69a2bc0cdc3fea0f
>>>> 6184ce319b49c549ba9ce9e6a5ec4fd9
>>>> 1c9b1eaef2cc4c55c05b2d0a4cc9d3da
>>>> 1f25cdb1ab6aae385414adc60fd0a31f
>>>> bd4a2310fd5685e2cdd284c4d3556210
>>>> 37cff33723b77a7ed8dcc2b625abc443
>>>> 28a7c2eaf9496d5cf33ab043730c3c8c
>>>> 2524d60ef6d2ef87c8fd7e31ec723bef
>>>> f888ca00784a096b13a9a02854ee9a20
>>>> 3b33768d83da59ed83490d6d1f1e3e92
>>>> bc738b31483e8b6be0a7a043045a011e
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 8917f23ea6169b7e54f5d7569e2184b7
>>>> 60fe5e50fbcd0d6b1830583ffec47801
>>>> ee058862528053302694b193968643a5
>>>> eb693fd5c83093ec70845f2ae111edd9
>>>> f46c42d218a0a16ffb5e5fa8dfc13249
>>>> eeaaf86088287cede457a6a3712cc079
>>>> 440e888e38bd9886b125b23c31ef1801
>>>> 9315ba9a21a33f230799f53d76ab6aff
>>>> 82b3534476879db9cca52ec4d02a2679
>>>> 1c9b1eaef2cc4c55c05b2d0a4cc9d3da
>>>> 34452cfdf6846058dc01cb32b32657be
>>>> 338108166b81204e2fd5ca532ae5ae14
>>>> 37cff33723b77a7ed8dcc2b625abc443
>>>> f973c2962b62835e92742b9698d461f3
>>>> c3193eb5e383ffe3b4cb34f9a82b6d91
>>>> 06ee0cdcdcefa6cd6c5ab0bac33afb3e
>>>> cc18e761ffb4b5aef8c2c6102cab6783
>>>> b0a24ed819ffc554a51abd4bf360ea89
>>>> 6726b7d93822b6e605370e2df32fe321
>>>> 0797907a3f3716e2247616dcc6b6ff36
>>>> 84855f029b32f0a85eadc455bec3797e
>>>> 0ef1cbe21692649d3b768637233bc411
>>>> fc6df0c9107d38fbb374ea8ece6de9fc
>>>> 027dcb9c1dfa48cac65b6f529bec5c21
>>>> 7f4c4f9cf4f31970cdddc85dc8d00fa0
>>>> c3193eb5e383ffe3b4cb34f9a82b6d91
>>>> 9df9633bf33e5488986de0c942e33fae
>>>> bc738b31483e8b6be0a7a043045a011e
>>>> 84bb4d12d454a56941a4eb15a0474150
>>>> 08ba8e8942339643d09312119d8ffc3f
>>>> 78ceb18607b38dcd290bd24c3196ba41
>>>> 68c037d6b791400ac9b92ad192799d6d
>>>> 8917f23ea6169b7e54f5d7569e2184b7
>>>> 5ac2b20d5bb0ccea977e09c51fbbd1b9
>>>> 3b33768d83da59ed83490d6d1f1e3e92
>>>> 779b0aa2ada8834c12f34eba7710e50e
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> cd03e7335580d1e035e962734c801744
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> e91991170459509664aa3d6209efd2eb
>>>> c3193eb5e383ffe3b4cb34f9a82b6d91
>>>> cc96618e63165bc031f9321229a94084
>>>> f4b39a6a822aa3e53325b71900dd6e59
>>>> d19bd53c3926df70f8345ccc55e3f1d4
>>>> 194aab685f474136724e8ddbf4a03f9b
>>>> ea142a4b76756468bd35e9e479e0d64b
>>>> 61650e0e765f19a9dc79081b6417e4fa
>>>> ad2b00cb5946c60227b0939f2913c403
>>>> 358c7d33cd94f6f4ed73146159d8d8ed
>>>> fb3e5b630c6baa84285ddc3123bb8a2d
>>>> f3d3f36c34b9bba73c367f8604c47bbf
>>>> d474ad9c38679d83c78cdc29f7890bf2
>>>> 4d604102194a4150f834d8ccda38e288
>>>> f973c2962b62835e92742b9698d461f3
>>>> fde7d2ff5a02f3b98ac28023cab092ca
>>>> eb693fd5c83093ec70845f2ae111edd9
>>>> f64bb9a4cfc5ad697cea18a29f41d099
>>>> fc6df0c9107d38fbb374ea8ece6de9fc
>>>> 681b7cc1afedf142dae47ef67c98c332
>>>> e19af5b54914b3045dbe923b9b52808b
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> 9778505b5f587e6abaac62f4ec709b31
>>>> b7146c28f937b07c1e3df73c650a2de0
>>>> b1ca954873c9452efb5374c12acee4a6
>>>> 879ebef6d871ba3a27fed3482a93526f
>>>> 08ba8e8942339643d09312119d8ffc3f
>>>> a91e4995c237e0c3848bfd8baeb3bba6
>>>> c24adf17f3bc1606e766ab3a4c441a4d
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 634528ccea8004f13612f3146611cbaa
>>>> 8917f23ea6169b7e54f5d7569e2184b7
>>>> 346a15c88a439820736c0519d3ff39e0
>>>> eb693fd5c83093ec70845f2ae111edd9
>>>> f46c42d218a0a16ffb5e5fa8dfc13249
>>>> 08ba8e8942339643d09312119d8ffc3f
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> fc04088eb26044a4a6f14e257152ee31
>>>> eb693fd5c83093ec70845f2ae111edd9
>>>> 038fee0e92aec9ce86a7d7caf59a500c
>>>> 2f93f0d9215320db9fc2243867e5d6bc
>>>> e0a1b0470d8a7a7286acc4571fc82d9f
>>>> bc738b31483e8b6be0a7a043045a011e
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 1c9b1eaef2cc4c55c05b2d0a4cc9d3da
>>>> 034da446d80d118d2a33528240fe7506
>>>> fbc0cb47a6e729b7d6723e3c4c45b82d
>>>> 1ae13e36008b8fec094d3a6e2d9236a5
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> cc96618e63165bc031f9321229a94084
>>>> 00d634aac185696d25f4abce6f7f4441
>>>> 194aab685f474136724e8ddbf4a03f9b
>>>> f3d3f36c34b9bba73c367f8604c47bbf
>>>> f973c2962b62835e92742b9698d461f3
>>>> 5a3e6fac352988401876162cb7b5adc1
>>>> c3193eb5e383ffe3b4cb34f9a82b6d91
>>>> db7e3efd52c56957eb902089c5a51b1a
>>>> 038fee0e92aec9ce86a7d7caf59a500c
>>>> bc738b31483e8b6be0a7a043045a011e
>>>> 8917f23ea6169b7e54f5d7569e2184b7
>>>> 3b33768d83da59ed83490d6d1f1e3e92
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 3dd983f08ba3e5c93b48150090632e59
>>>> 37cff33723b77a7ed8dcc2b625abc443
>>>> 24bf878ea2cd0e4aad3736eb61473dac
>>>> 6568839e37176ff69e82bca37913c7f4
>>>> 34452cfdf6846058dc01cb32b32657be
>>>> 338108166b81204e2fd5ca532ae5ae14
>>>> dcced6eb64e254d071738e7b3632bfb5
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> 1eec732fa1f5d36e16c76bc84bc8ee0e
>>>> ddcca6704843f53f0749d90fc40a9ef2
>>>> c42ddb18a446db126b2c7825b641ca32
>>>> 209d1894e5383eae26f7c55a4d2b395f
>>>> 22c4a9f90ccc4eab7e41ccf8ffef0c9a
>>>> 651b66dc04cee99277024f6549145be8
>>>> a9e5240f5dedf20dd3a0baf6f14a050a
>>>> 83e1fa5040928b53b9d2e11a05407fa8
>>>> c3193eb5e383ffe3b4cb34f9a82b6d91
>>>> e3ed65914f31fcff17b8800869733438
>>>> 1ab8630525fbd54b7ad54c9a366a74c3
>>>> a81b4f36869d30aa001b6de2a15607fc
>>>> 552d82ddb132135460992e43d5ae868c
>>>> d547528d064892bd4d7609eb740c13bb
>>>> 1557566d6104f70bfc042c31e8a2af2d
>>>> ee36b9324e62fa7e8e4c821143908e6f
>>>> 6113f3ef3a0b26558ecea24fda47af06
>>>> 8cbc4f519bc155b4d858b0ba0aa16869
>>>> f973c2962b62835e92742b9698d461f3
>>>> c3193eb5e383ffe3b4cb34f9a82b6d91
>>>> ffb6beb18b1f6b3955a59ad30c3928c5
>>>> f4b3cda094eb5c4c1ab0ce2ee53e0e5f
>>>> cc96618e63165bc031f9321229a94084
>>>> f3d3f36c34b9bba73c367f8604c47bbf
>>>> f011a57578ca43bf1ef1f65145a33ecb
>>>> fc6df0c9107d38fbb374ea8ece6de9fc
>>>> dd17e9cdef83b9742b0cfa24c9eaf6cd
>>>> 2524d60ef6d2ef87c8fd7e31ec723bef
>>>> 346a15c88a439820736c0519d3ff39e0
>>>> 46d5161ecfdab546a10231f2feb7db55
>>>> f46c42d218a0a16ffb5e5fa8dfc13249
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 8917f23ea6169b7e54f5d7569e2184b7
>>>> 08ba8e8942339643d09312119d8ffc3f
>>>> 5fde21b2dc11fd9c2e2e7d4b92db3b0a
>>>> d2342da5e29c36eda08605aa6196eb84
>>>> 4ae4dfca358947af85c91f27cfc3e52b
>>>> 6ce085d2232b01f244cceae80d8e3663
>>>> db5a2e1d49bf5a58f0d52e19957ce764
>>>> 266c6c8c2e13ed19fb34e8f8388352c4
>>>> 83e1fa5040928b53b9d2e11a05407fa8
>>>> 83e1fa5040928b53b9d2e11a05407fa8
>>>> cc96618e63165bc031f9321229a94084
>>>> 00d634aac185696d25f4abce6f7f4441
>>>> f3d3f36c34b9bba73c367f8604c47bbf
>>>> 194aab685f474136724e8ddbf4a03f9b
>>>> fc04088eb26044a4a6f14e257152ee31
>>>> 7c146f987d7ebe995899ee22525e8b12
>>>> eb693fd5c83093ec70845f2ae111edd9
>>>> ee1a7c30427a8e81686a54e18282bca3
>>>> b4032344c17375638eb104baa70b3987
>>>> a197db858c792f2d8c78acd9cfaba3a2
>>>> 901f086dda342a86e1ac9af4259ae67f
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> 0797907a3f3716e2247616dcc6b6ff36
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> 1c9b1eaef2cc4c55c05b2d0a4cc9d3da
>>>> 1c9b1eaef2cc4c55c05b2d0a4cc9d3da
>>>> 1c9b1eaef2cc4c55c05b2d0a4cc9d3da
>>>> b4c4e87e1fbda0a78dfb7bcabdb7a7e9
>>>> 2524d60ef6d2ef87c8fd7e31ec723bef
>>>> f888ca00784a096b13a9a02854ee9a20
>>>> 7c146f987d7ebe995899ee22525e8b12
>>>> 20b0694f0a810133498980e705ec667e
>>>> 6ef4ffca531c2d48c953115a45b43d0b
>>>> fc04088eb26044a4a6f14e257152ee31
>>>> 20b0694f0a810133498980e705ec667e
>>>> 2524d60ef6d2ef87c8fd7e31ec723bef
>>>> 7e20d84afde66d47b213579dd7225371
>>>> e4274cbdc4d39a1b73e382bf07d8a551
>>>> e02662e9898e07461e12a905c1f6f11c
>>>> 681b7cc1afedf142dae47ef67c98c332
>>>> fc6df0c9107d38fbb374ea8ece6de9fc
>>>> f3d3f36c34b9bba73c367f8604c47bbf
>>>> 00d634aac185696d25f4abce6f7f4441
>>>> 194aab685f474136724e8ddbf4a03f9b
>>>> cc96618e63165bc031f9321229a94084
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> 9a7e37b646cfc9f8ca43d101d9d1f580
>>>> 6568839e37176ff69e82bca37913c7f4
>>>> 8917f23ea6169b7e54f5d7569e2184b7
>>>> 7383b7a9895640233fc714dcfc8bfc76
>>>> 24bf878ea2cd0e4aad3736eb61473dac
>>>> 135c7633b1cd5f8f4f65d2dee099aa23
>>>> 038fee0e92aec9ce86a7d7caf59a500c
>>>> 37cff33723b77a7ed8dcc2b625abc443
>>>> 3dd983f08ba3e5c93b48150090632e59
>>>> d5d2879b7d80c96738f26da443c5af43
>>>> 5f6b1473e32ff0c8c461a6fd3c571ea4
>>>> 9a776ee1eaa1e164d109647970cd3585
>>>> fbc0cb47a6e729b7d6723e3c4c45b82d
>>>> 6268bfab73d481ce860f0938388e11d3
>>>>
>>>>
>>>> On 23. 05. 14 10:26 , Al Varnell wrote:
>>>>
>>>>   We always do that right here.
>>>>> -Al-
>>>>>
>>>>>
>>>>> On Fri, May 23, 2014 at 01:23 AM, DUCARROZ Birgit wrote:
>>>>>
>>>>>   ok. Where do I have to submit the md5s ?
>>>>>> - Birgit
>>>>>>
>>>>>>
>>>>>> On 22. 05. 14 01:01 , Alain Zidouemba wrote:
>>>>>>
>>>>>>   The new signature will be out in the next few releases.
>>>>>>> If you could, please provide the md5s or sha256s of the samples that
>>>>>>> alerted.
>>>>>>>
>>>>>>> Thanks,
>>>>>>>
>>>>>>> - Alain
>>>>>>>
>>>>>>> On Wednesday, May 21, 2014, DUCARROZ Birgit <birgit.ducarroz at unifr.ch
>>>>>>> wrote:
>>>>>>>
>>>>>>>    Thank you a lot! When will it be replaced?
>>>>>>>
>>>>>>>> I had 317 "infected" files and now I don't know if they are false
>>>>>>>> positives or not.
>>>>>>>> Curiously chkrootkit gave me this:
>>>>>>>>
>>>>>>>> < You have     1 process hidden for readdir command
>>>>>>>>
>>>>>>>> < You have     1 process hidden for ps command
>>>>>>>>
>>>>>>>> < chkproc: Warning: Possible LKM Trojan installed
>>>>>>>>
>>>>>>>> but this message disappeared also one or two days later.
>>>>>>>> Since the most of the "infected" files are old, I wonder if they
>>>>>>>> might
>>>>>>>> have been infected afterwards...
>>>>>>>>
>>>>>>>> - Birgit
>>>>>>>>
>>>>>>>>
>>>>>>>> On 21. 05. 14 22:09 , Alain Zidouemba wrote:
>>>>>>>>
>>>>>>>>    It was dropped for performance reasons. We found it be generating
>>>>>>>> some
>>>>>>>>
>>>>>>>>> false positives, such as the one you likely had. The signature
>>>>>>>>> Unix.Trojan.ElkKnot will be replaced with a better performing one.
>>>>>>>>>
>>>>>>>>> - Alain
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> On Wed, May 21, 2014 at 4:07 PM, DUCARROZ Birgit
>>>>>>>>> <birgit.ducarroz at unifr.ch>wrote:
>>>>>>>>>
>>>>>>>>>     Why has it been dropped? Should I believe now that I have this
>>>>>>>>> trojan or
>>>>>>>>>
>>>>>>>>>   not?
>>>>>>>>>>
>>>>>>>>>> On 21. 05. 14 14:31 , Alain Zidouemba wrote:
>>>>>>>>>>
>>>>>>>>>>     The signature "Unix.Trojan.ElkKnot" has been dropped from our
>>>>>>>>>> signature
>>>>>>>>>>
>>>>>>>>>>   set
>>>>>>>>>>> a few releases ago.
>>>>>>>>>>>
>>>>>>>>>>> - Alain
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> On Wed, May 21, 2014 at 5:46 AM, DUCARROZ Birgit
>>>>>>>>>>> <birgit.ducarroz at unifr.ch>wrote:
>>>>>>>>>>>
>>>>>>>>>>>      Sorry, I forgot to note my question:
>>>>>>>>>>>
>>>>>>>>>>>    Does somebody know what this might be?
>>>>>>>>>>>
>>>>>>>>>>>> When I am scanning now the same files, this messages does not
>>>>>>>>>>>> appear
>>>>>>>>>>>> again.
>>>>>>>>>>>> Actual version: ClamAV 0.97.8/19011/Wed May 21 09:48:13 2014
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> On 21. 05. 14 11:41 , DUCARROZ Birgit wrote:
>>>>>>>>>>>>
>>>>>>>>>>>>      Hi,
>>>>>>>>>>>>
>>>>>>>>>>>>    as of 05/13/2014 I had suddenly a lot of older files with
>>>>>>>>>>>>
>>>>>>>>>>>>> notification
>>>>>>>>>>>>>
>>>>>>>>>>>>> Unix.Trojan.ElkKnot FOUND
>>>>>>>>>>>>>
>>>>>>>>>>>>> Regards,
>>>>>>>>>>>>>
>>>>>>>>>>>>>   _______________________________________________
>>>> Help us build a comprehensive ClamAV guide:
>>>> https://github.com/vrtadmin/clamav-faq
>>>> http://www.clamav.net/support/ml
>>>>
>>>>   _______________________________________________
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/vrtadmin/clamav-faq
>>> http://www.clamav.net/support/ml
>>>
>> --
>> Birgit Ducarroz
>> Unix Systems Administration
>> Department of Informatics
>> University of Fribourg Switzerland
>> mailto:birgit.ducarroz at unifr.ch
>> Phone: +41 (26) 300 8342
>> https://diuf.unifr.ch/people/ducarroz/
>>
>> _______________________________________________
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>> http://www.clamav.net/support/ml
>>
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> http://www.clamav.net/support/ml

-- 
Birgit Ducarroz
Unix Systems Administration
Department of Informatics
University of Fribourg Switzerland
mailto:birgit.ducarroz at unifr.ch
Phone: +41 (26) 300 8342
https://diuf.unifr.ch/people/ducarroz/

More information about the clamav-users mailing list