Re: [cobalt-users] Chkrootkit - possible slapper worm

[Csaba Albert <maka_cs@xxxxxxxxx>]

--- Richard Siddall  wrote:
> Andy Clyde, oxfordmusic.net wrote:
> > no. checked that and nothing on these ports (at
> least not via netstat -an).
> > funnily enough, i deleted some files from /tmp and
> the warning went away
> > (not straightaway but overnight). i am running
> RealServer which does use
> > some funny ports but none of the ones listed
> above.
> > is it safe to assume that it was a false positive?

Sometimes I'm getting the same chkrootkit output:

Checking `slapper'... Warning: Possible Slapper Worm
installed

I am running Bruce's chkrootkit package, which is
installed as a cron job to run twice a day. The
message appears randomly and on the next chkrootkit
scan it goes away.

Csaba


__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com