Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

ran rkhunter tonight, and I got this for the results:

[04:17:34] System checks summary
[04:17:34] =====================
[04:17:34]
[04:17:34] File properties checks...
[04:17:34] Files checked: 133
[04:17:34] Suspect files: 16
[04:17:34]
[04:17:34] Rootkit checks...
[04:17:34] Rootkits checked : 245
[04:17:34] Possible rootkits: 1
[04:17:34] Rootkit names    : Slapper Worm
[04:17:34]
[04:17:34] Applications checks...
[04:17:34] All checks skipped
[04:17:34]
[04:17:34] The system checks took: 2 minutes and 27 seconds
[04:17:34]
[04:17:34] Info: End date is Sat Jul 12 04:17:34 UTC 2014

Says possible rootkit "Slapper Worm", and it points to this file:

[04:16:42] Checking for Slapper Worm...
[04:16:42]   Checking for file '/tmp/.bugtraq'               [ Not found ]
[04:16:42]   Checking for file '/tmp/.uubugtraq'             [ Not found ]
[04:16:42]   Checking for file '/tmp/.bugtraq.c'             [ Not found ]
[04:16:42]   Checking for file '/tmp/httpd'                  [ Not found ]
[04:16:42]   Checking for file '/tmp/.unlock'                [ Not found ]
[04:16:42]   Checking for file '/tmp/update'                 [ Found ]
[04:16:42]   Checking for file '/tmp/.cinik'                 [ Not found ]
[04:16:43]   Checking for file '/tmp/.b'                     [ Not found ]
[04:16:43] Warning: Slapper Worm                             [ Warning ]
[04:16:43]          File '/tmp/update' found

I removed this file, but it didn't appear to be anything to serious? Should I be worried that I may have a rootkit? Will removing this file fix the issue?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

In this case, I wouldn't be too worried as it only detected a filename to be present that is not unlikely to be created by something completely unrelated due the common nature of the word update. The more important files like /tmp/.bugtraq are missing. Also, Slapper is 12 years old and used a vulnerability that has long been closed.

If you run rkhunter because you suspected an infection, you could investigate further, but if it was a routine operation, close the matter.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.