Andy Clyde, oxfordmusic.net wrote:
no. checked that and nothing on these ports (at least not via netstat -an). funnily enough, i deleted some files from /tmp and the warning went away (not straightaway but overnight). i am running RealServer which does use some funny ports but none of the ones listed above. is it safe to assume that it was a false positive?
I don't know. I'd be happier if I knew why you got the warning in the first place. If you did have a slapper worm, at this point you've probably deleted the binary. At worst it's hanging around in memory. You might want to check ps or reboot the box.
(Incidentally, I don't know much about slapper.) Richard.