Re: Possible Slapper Worm Infection
Incoming from Barry Skidmore:
>
> On Thu, Jan 15, 2004 at 05:21:05PM -0500, Barry Skidmore wrote:
> > I am using Debian (woody)-i386 on a home network.
> >
> > I run chkrootkit (0.43) daily, and today's report suggests that I might
> > have been infected with the 'slapper' worm. Network Associates web site
>
> ********************************************************
> Sorry, I meant to say 'scalper' worm, NOT 'slapper' worm
> ********************************************************
I reported a bug a couple of versions ago where scalper was
mis-reported. Scalper is supposed only to go for *BSD systems running
apache. Are you sure you're running 0.43?
BTW, chkrootkit questions are better answered in chkrootkit-users and
archives:
http://marc.theaimsgroup.com/?l=chkrootkit-users
--
Any technology distinguishable from magic is insufficiently advanced.
(*) http://www.spots.ab.ca/~keeling
- -
Reply to: