Colin Brace wrote:
>
>
> CyberLeo Kitsana wrote:
>>
>> Are these files available in a tarball someplace public, for those of us
>> who enjoy performing autopsies on virii?
>
> Sure thing: http://silenceisdefeat.com/~cbrace/www_badstuff.gz
>
> this tarball contains "tmpfile" which is the misbehaving script as well as
> the contents of a directory called ".," which has a bunch of source code
> and so on. As indicated earlier, this stuff was installed by user 'www'.
>
> It should be unpacked in an empty directory.
Oops, I missed six more files written by www to /tmp. Here they are:
http://silenceisdefeat.com/~cbrace/www_badstuff-2.gz
-----
Colin Brace
Amsterdam
http://lim.nl
--
View this message in context:
http://www.nabble.com/what-www-perl-script-is-running--tp25112050p25149271.html
Sent from the freebsd-questions mailing list archive at Nabble.com.
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
