Re: [cobalt-users] Chkrootkit - possible slapper worm

[Richard Siddall <cobalt@xxxxxxxxxxx>]

Andy Clyde, oxfordmusic.net wrote:
> netstat -an does reveal something listening on port 4156 (Slapper.c uses
> this port) but it seems to be an ASP thing.
>
> tcp        0    0    127.0.0.1:3001    127.0.0.1:4156    ESTABLISHED
> tcp        0    0    127.0.0.1:4156    127.0.0.1:3001    ESTABLISHED

Try restarting the ASP service to see if it uses a different port.

> how do i view the chkrootkit binary to find out what it's looking for for
> Slapper?

cd <directory containing chkrootkit>

vi chkrootkit  (or pico, if you prefer that over vi)

chkrootkit is a shell script.