[clug] Re: linux Digest, Vol 31, Issue 25

[Conrad Canterford]

On Fri, 2005-07-22 at 11:28 +1000, Chris wrote:
> Just as the way you pointed out, there were indeed, lots of http requests,
> and this keeps happening until now. As far as I have gathered, the system
> was somehow instructed to download some Perl files and put them in the
> /tmp folder. Then communicate to a specific server, I presume that is what
> the Perl files were asking it to do. I have hundreds of those Perl files,
> with the same name, but different extensions, something like 001, 002 ...

Are you running AWStats? If so, uninstall it NOW and do not reinstall
it. I do recommend the blow-it-away-and-restart-from-scratch approach to
fixing this.

A compromise was found in awstats many months ago, and to the best of my
knowledge has not been fixed yet.

Conrad.