cinik

[andleg]

Does anybody else get this type of program started :
apache   15431  0.0  0.8  2252  768 ?        S    Oct23   0:00
/tmp/.socket2/.cinik 12.98.201.243

I am running linux redhat 7.3.
When I make a locate on cinik I find a lot of copy on a lot of place of
.cinik.

This program copy itself in a lot of place and add a line in apache cron
to restart itself. The Ip adress it call is different very often.
When I trace it I arrive on some att dsl line (may be he jump from one
to another)

That look like a virus but I am sure of nothing.

Andre Legendre



-------------------------------------------------------
This sf.net email is sponsored by: Influence the future 
of Java(TM) technology. Join the Java Community 
Process(SM) (JCP(SM)) program now. 
http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavote