cinik

[andleg]

I made it first, but I want other guys know to control on them side.
Plus I want to stop that.

Andre Legendre
Troy Corbin a écrit :

> you are infected with the Slapper worm:
>
> http://vil.nai.com/vil/content/v_99711.htm
>
> remove your machine from the network AT ONCE!
>
> -t
>
> On Thu, 24 Oct 2002, andleg wrote:
>
> > Does anybody else get this type of program started :
> > apache   15431  0.0  0.8  2252  768 ?        S    Oct23   0:00
> > /tmp/.socket2/.cinik 12.98.201.243
> >
> > I am running linux redhat 7.3.
> > When I make a locate on cinik I find a lot of copy on a lot of place of
> > .cinik.
> >
> > This program copy itself in a lot of place and add a line in apache cron
> > to restart itself. The Ip adress it call is different very often.
> > When I trace it I arrive on some att dsl line (may be he jump from one
> > to another)
> >
> > That look like a virus but I am sure of nothing.
> >
> > Andre Legendre
> >
> >
> >
> > -------------------------------------------------------
> > This sf.net email is sponsored by: Influence the future
> > of Java(TM) technology. Join the Java Community
> > Process(SM) (JCP(SM)) program now.
> > http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavote
> > _______________________________________________
> > Nagios-users mailing list
> > Nagios-users at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/nagios-users
> >



-------------------------------------------------------
This sf.net email is sponsored by: Influence the future 
of Java(TM) technology. Join the Java Community 
Process(SM) (JCP(SM)) program now. 
http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavote