Re: Possible Slapper Worm Infection

[skidmore@digital-village.net (Barry Skidmore)]

********************************************************
Sorry, I meant to say 'scalper' worm, NOT 'slapper' worm
********************************************************

On Thu, Jan 15, 2004 at 05:21:05PM -0500, Barry Skidmore wrote:
> I am using Debian (woody)-i386 on a home network.
> 
> I run chkrootkit (0.43) daily, and today's report suggests that I might
> have been infected with the 'slapper' worm.  Network Associates web site
> has a good description of this worm, including some of the symptoms of
> the infection.  These include the presence of the following files:
> 
> bugtracq.c
> bugtracq
> uubugtraq
> new entries in the crontab file
> 
> I do not have any of these symptoms, and a run of f-prot does not reveal
> any infected files.
> 
> Has anyone else had experience with this worm, and/or suggestions for
> the next step?  I know the obvious thing would be to reformat and
> reinstall (and this time do not run Apache), but I am wondering if there
> might be other options.
> 
> Thanks,
> Barry
> 
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>