xxkylexx

Well-Known Member
Apr 29, 2006
57
0
156
Hello,

I got an email from my daily chkrootkit and noticed this line for the first time:


Checking `slapper'... Warning: Possible Slapper Worm installed (32076/mocks)

Can anyone tell me what this is, and what I need to do with it?



Thanks,
Kyle
 

chirpy

Well-Known Member
Verifed Vendor
Jun 15, 2002
13,465
30
473
Go on, have a guess
It's more than likely a false-positive as it's normally just finding the port that slapper uses. Rerun chkrootkit and see if it's still there.
 

AndyReed

Well-Known Member
PartnerNOC
May 29, 2004
2,221
4
193
Minneapolis, MN
xxkylexx said:
Hello,

I got an email from my daily chkrootkit and noticed this line for the first time:

Code:
Checking `slapper'... Warning: Possible Slapper Worm installed (32076/mocks)
SSH to your server and run ./chkrootkit one more time. If it comes up Checking `slapper'... not infected then you know it was a false entry. If it comes up again telling you Checking `slapper'... Warning: Possible Slapper Worm installed, then you should wait a minute and run the ./chkrootkit a 3rd time to verify it is really installed. If it is you need to take measures to secure your server now, and attempt at removing the slapper worm. In some cases you might need to reload your OS. In any case, secure and harden your server.