>Daniel -- did you happen to run any of the commands in the compromised user >account as root? Yesterday, I examined the directory ~daikanyama/.undernet and probably I executed mech as root. The file mech is indeed infected by Linux/Rst-B. This explains everything....... Does anyone know whether .undernet/mech has another purpose than distributing the Linux/Rst-B virus??? -- +++ Sparen beginnt mit GMX DSL: http://www.gmx.net/de/go/dsl
