This is rather scary.

No.2 · 10-30-2006, 01:53 PM

My fire wall firestarter says I have cheese worm trying to talk on 10008 yet I can't find any sign of it; no /tmp.cheese and a clean sweep with KlamAV of the whole system.

And I just had aMule start by its self with my whole / dir shared! And it froze every time I tried to change that.

Should I be worried?

Sabayon 3.0 running as user.

sleepyEDB · 10-30-2006, 03:40 PM

Do you have (or can you install if you don't) rootkit hunter or chkrootkit? They may be able to find something that KlamAV did not.

sleepy

Hangdog42 · 10-30-2006, 04:30 PM

Unplug this box from the network until you can figure out what is going on, and here is a good place to start. Having programs start by themselves and sharing entire partitions is not good.

No.2 · 10-31-2006, 02:12 PM

Thanks for the help guys. That site is awsome! I got a clean run with Klam rkhunter and chkrootkit. I added rkhunter to a daily cron job. There is no sign of Cheese worm. I have xinetd.conf and not inetd.conf so Cheese wouldn't have modded that. Thinking it must be something else trying to talk on 10008?? Reinstalled amule and no more issues. Now just to go through the CERT site.

Thanks again.