Results 1 to 7 of 7
  1. #1
    Join Date
    Feb 2004
    Posts
    121

    CHKROOTKIT shows:Slapper Worm installed

    hello,
    I just run CHKROOTKIT on my linux server ( w/ whm ) i find below
    2 infected files, How do I remove it?


    Checking `bindshell'... INFECTED (PORTS: 465)
    Checking `slapper'... Warning: Possible Slapper Worm installed

    thanks in advance for the help..

    Javad

  2. #2
    Join Date
    Jan 2004
    Posts
    445

  3. #3
    Join Date
    Feb 2004
    Posts
    121
    Thanks for help...ok port 465 using WHM and chkrootkit says infected... and this is normal..
    but about slapper worm :
    i just run chkrootkit again, this time chkrootkit shows
    Checking `slapper'... not infected !!

    i have not run any program to remove the slapper !!!
    is this a bug in chkrootkit ?

    thanks

  4. #4
    Like us on Facebook to qualify for discounts!
    http://www.sprintserve.net
    Offering: | Internap FCP Bandwidth! | Rebootless Kernel Updates! | Magento Optimized Hosting | Wordpress Hosting |
    Services: | Managed Multiple Cores 64bit Servers | Server Management |

  5. #5
    Join Date
    Apr 2003
    Location
    San Francisco, CA
    Posts
    428
    I find that sometimes you get false alarms from chkrootkit. Just make sure it is a false alarm
    Hostito, Inc. - Web Hosting & Reseller Plans
    http://www.hostito.com
    [email protected] - 1 888 467 8486

  6. #6
    Join Date
    Jun 2003
    Posts
    961
    check http://www.ravantivirus.com/virus/showvirus.php?v=121. they do describe some removal instructions which might help you

  7. #7
    Join Date
    Mar 2003
    Location
    California USA
    Posts
    13,294
    run rkhunter, it finds things chkrootkit leaves behind.
    Steven Ciaburri | Industry's Best Server Management - Rack911.com
    Software Auditing - 400+ Vulnerabilities Found - Quote @ https://www.RACK911Labs.com
    Fully Managed Dedicated Servers (Las Vegas, New York City, & Amsterdam) (AS62710)
    FreeBSD & Linux Server Management, Security Auditing, Server Optimization, PCI Compliance

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •