How to Remove a Slapper Worm
The Slapper Worm is part of a family of worms that target Apache Web server installations on Intel-based machines with Linux operating systems from Red Hat, SuSE, Mandrake, Slackware or Debian. The worm uses an OpenSSL buffer overflow exploit to run a shell on a remote computer and contains code for Distributed Denial of Service (DDoS) attack. Apache and OpenSSL must be enabled, and OpenSSL version must be 0.96d or older. Initial reports of the worm originated in Portugal and Romania on September 13, 2002.
Other People Are Reading
Instructions
-
-
1
Open a terminal on your machine that will allow access to the command line. Depending on the version of your operating system, look for programs called Xterm, terminal, Konsole or console. The icon for the shell will generally have the shape of a computer screen.
-
2
Use the pidof command from the prompt to determine the process ID (PID) of the worm's ".bugtraq" process by typing the following command: "pidof .bugtraq". The output returned will be a four-digit number, the process ID, e.g., 3486.
-
-
3
Kill the bugtraq process by typing the kill command followed by the process ID as follows: "kill -9 3486." The -9 is a special signal that kills the active process.
-
4
Type "cd /tmp" to access the temp directory of the system. The worm stores its program files there.
-
5
Delete the worm's program files from within the /tmp directory as follows:
"rm /tmp/.uubugtraq"
"rm /tmp/.buqtraq.c"
"rm /tmp/.bugtraq" -
6
Reboot the Apache web server to complete the removal process.
-
1
Tips & Warnings
Upgrade the machine's OpenSSL library to a fixed version of 0.9.6e or above to avoid further reinfection.
