Re: [cobalt-users] Chkrootkit - possible slapper worm

["Andy Clyde, oxfordmusic.net" <cobalt-users@xxxxxxxxxxxxxxx>]

>
> I don't know.  I'd be happier if I knew why you got the warning in the
> first place.  If you did have a slapper worm, at this point you've
> probably deleted the binary.  At worst it's hanging around in memory.
> You might want to check ps or reboot the box.
>

any tips on how i might find out why this warning is occurring (i'm still
getting in periodically, say 1 in every 3 runs of chkrootkit)?

the only file i can find which looks like one of slapper's is /sbin/update
but this has the same timestamp and file size as the same file on another of
my RaQ4s.
netstat -an does reveal something listening on port 4156 (Slapper.c uses
this port) but it seems to be an ASP thing.

tcp        0    0    127.0.0.1:3001    127.0.0.1:4156    ESTABLISHED
tcp        0    0    127.0.0.1:4156    127.0.0.1:3001    ESTABLISHED

how do i view the chkrootkit binary to find out what it's looking for for
Slapper?

andy