> That looks like the ftp scanner which can be found at > <http://wayreth.eu.org/> - somebody is probably using your box to find > insecure ftp servers for sharing files. > > Can you do an "ls -lah /dev/shm/..\ /"? > > Ralph Besides killing what's running, how do I get this all cleaned up? The hotmail account has been denied logins now. I've also set a new password on the account. Thanks, James