[CentOS] I appear to be attacking others

James Pifer wrote:
> 
> > Find one of the processes that's still alive and do "ls -l /proc/<pid>".
> > That will give you some info about it. The exe entry should be a link to
> > the executable itself.
> > 
> 
> ok, I found it. Now what? You said run strings? I get:
>  Multi-thread FTP scanner v0.2.5 by Inode <inode at wayreth.eu.org>

That looks like the ftp scanner which can be found at
<http://wayreth.eu.org/> - somebody is probably using your box to find
insecure ftp servers for sharing files.

Can you do an "ls -lah /dev/shm/..\ /"?

Ralph
-- 
Ralph Angenendt......ra at br-online.de | .."Text processing has made it possible
Bayerischer Rundfunk...80300 München | ....to right-justify any idea, even one
Programmbereich.Bayern 3, Jugend und | .which cannot be justified on any other
Multimedia.........Tl:089.5900.16023 | ..........grounds." -- J. Finnegan, USC
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://lists.centos.org/pipermail/centos/attachments/20060205/2507fb2b/attachment-0001.sig>