cinik

[Troy Corbin]

you are infected with the Slapper worm:

http://vil.nai.com/vil/content/v_99711.htm


remove your machine from the network AT ONCE!

-t


On Thu, 24 Oct 2002, andleg wrote:

> Does anybody else get this type of program started :
> apache   15431  0.0  0.8  2252  768 ?        S    Oct23   0:00
> /tmp/.socket2/.cinik 12.98.201.243
> 
> I am running linux redhat 7.3.
> When I make a locate on cinik I find a lot of copy on a lot of place of
> .cinik.
> 
> This program copy itself in a lot of place and add a line in apache cron
> to restart itself. The Ip adress it call is different very often.
> When I trace it I arrive on some att dsl line (may be he jump from one
> to another)
> 
> That look like a virus but I am sure of nothing.
> 
> Andre Legendre
> 
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future 
> of Java(TM) technology. Join the Java Community 
> Process(SM) (JCP(SM)) program now. 
> http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavote
> _______________________________________________
> Nagios-users mailing list
> Nagios-users at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nagios-users
> 



-------------------------------------------------------
This sf.net email is sponsored by: Influence the future 
of Java(TM) technology. Join the Java Community 
Process(SM) (JCP(SM)) program now. 
http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavote