Tiger reports possible Slapper worm, but chkrootkit disagrees.

From: Carl Fink (carlf_at_nitpicking.com)
Date: 01/31/04

  • Next message: Al Davis: "Re: Isolationism is history." 
    Date: Fri, 30 Jan 2004 21:22:00 -0500
To: debian-user@lists.debian.org

    I have Tiger Audit set up on my Sarge system. My last two reports say this:

    # Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks...
    OLD: --WARN-- [rootkit004f] Chkrootkit has detected a possible rootkit installation
    OLD: Warning: Possible Slapper Worm installed

    However, when I run chkrootkit itself, it says:

    Checking `slapper'... not infected

    So, is this a bug in Tiger? It isn't listed at bugs.debian.org.
    --
    Carl Fink carl@fink.to
    Jabootu's Minister of Proofreading
    http://www.jabootu.com 

    -- 
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: Al Davis: "Re: Isolationism is history."

    Relevant Pages

    • Re: chkrootkit warning
      ... >>When running chkrootkit 0.39 I resieved the following message: ... >>OooPS! ... >>Warning: Possible LKM Trojan installed ... I am running Redhat 8.0 and downloaded the disks from the RedHat ...
      (comp.os.linux.security)
    • Re: LKM Trojan installed
      ... Rivanor P. Soares wrote: ... Make sure you are running chkrootkit 0.39, ... I didn't get the 'xx process hidden for ps command', and the warning. ...
      (Focus-Linux)