RE: [cobalt-developers] Re: OpenSSL patch for Linux worm?

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Tue, 17 Sep 2002, Matthew Nuzum wrote:

<snip>
> BTW, I had one computer hit by the worm.  Fortunately it's very easy to
> clean.  There are three files in the /tmp folder.  .bugtraq, .bugtraq.c
> .uubugtraq. you can see them by running the ls -a command.  If you run
> ls -la you can see when you were violated.
>
> Remove the three files, do a ps -ax | grep bugtraq to find out the PID
> of the worm and then kill it.

Yes, one poster on the isp-linux list says;
" touch /tmp/.bugtraq;    chattr +i /tmp/.bugtraq
 touch /tmp/.bugtraq.c;  chattr +i /tmp/.bugtraq.c
 touch /tmp/.uubugtraq;  chattr +i /tmp/.uubugtraq
 ZZZZZZZZZZZZZZZZZ"
<snip>

Gerald
--
http://frontstreetnetworks.com | http://raqware.com
229 Front Street, Ste. C, New Haven, CT. 06513-3203
Phone: +1 203-785-0699