On Sat, 2002-12-28 at 13:45, Dennis Myers wrote: > Below is output from chkrootkit on my workstation. Notice the third line. I > have looked for the files that this infection is supposed to put in /tmp and > found nothing. The next variant "slapper" as you see is not detected. I have > updated openssl and do not run Apache on this machine, so the point of this > is what to check further and why would chkrootkit see this at all. Anyone > have a similar readout? Any suggestions are appreciated. TIA > <snipped the readout above this cause all was nothing found> > > Checking `rexedcs'... not found > Checking `sniffer'... Checking `wted'... nothing deleted > Checking `scalper'... Warning: Possible Scalper Worm installed > Checking `slapper'... not infected > Checking `z2'... > nothing deleted
When you're doing your manual "searching" - are you doing this from a terminal window and just using "ls" - or are you using the "ls -CFa" switches...? -- Sun Dec 29 07:35:00 EST 2002 7:35am up 13:13, 7 users, load average: 0.73, 0.74, 0.55 ------------------------------------------------------------------ | __ __ | kuhn media australia | | / ,, /| |'-. | http://kma.0catch.com | | .\__/ || | | |=================================| | _ / `._ \|_|_.-' | stephen kuhn | | | / \__.`=._) (_ | email: [EMAIL PROTECTED] | | |/ ._/ |"""""""""| | email: [EMAIL PROTECTED] | | |'. `\ | | | icq: 5483808 | | ;"""/ / | | | | | smk ) /_/| |.-------.| | mobile: 0410-728-389 | | ' `-`' " " | Berkeley, New South Wales, AU | ------------------------------------------------------------------ * linux user:267497 * RH 7.3+ * PC/Mac/Linux/Networking/Consulting ------------------------------------------------------------------ Cheit's Lament: If you help a friend in need, he is sure to remember you-- the next time he's in need.
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
