Re: [Hyperic-hq-discuss] worm report for libsigar-x86-linux.so

[Doug M. <do...@hy...>]

Hi,

terracotta-3.1.1 includes the sigar-1.6.3 release version, you can verify the files have not been tampered with by checking the md5.  They should match the following values:

% md5 lib/sigar-x86-winnt.dll 
MD5 (lib/sigar-x86-winnt.dll) = ed36c8473ea1479eb8439472b3274b68

% md5 lib/libsigar-x86-linux.so 
MD5 (lib/libsigar-x86-linux.so) = 67a4237ee6ad087f88caae0957247741

The 'Adore' worm is 9 years old and according to http://www.symantec.com/security_response/writeup.jsp?docid=2001-040516-0452-99
"Target of Infection: Linux systems with vulnerable wuftpd, bind, lprng, or statd"

Certainly sounds like a false alert.