Re: [cobalt-users] Detecting openssl Apache worm (slapper) automatically on your RaQs

["Andy Clyde, oxfordmusic.net" <andy.clyde@xxxxxxxxxxxxxxx>]

> --- "Michelle A. Hoyle" <mahlist@xxxxxxxxxxxxx> wrote:
> > The latest release of ChkRootKit (0.37) now detects
> > the Apache
> > OpenSSL worm (slapper) when run.  The latest version
> > is an easy
> > install on a RaQ.  Here's a set of instructions to
> > help you install
> > it, use it, and get it automated.
> >
> > Product Name: Chkrootkit-0.37
> > Web page: http://www.chkrootkit.org/
> > System Requirements: Intel-based RaQ boxes (3 & 4
> > for sure).
>
> I followed the instructions and ran chkroot with the
> following results on a RAQ2.  Please see the PASSWD
> entry.  Nothing else appears to be wrong.  What should
> I do now??
>
<snip>
> Checking `passwd'... INFECTED
</snip>

run it a couple more times to see if it's really a problem or just a false
positive (if a new process starts while chkrootkit is running it can cause
this).

andy