Samba 2.2.2: more than 100 nmbd processes

[Ionel GARDAIS]

I had the same problem and it happens again today !

Folks here told me about the Nimda Win32 Worm that is
trying to access the shares to spread.


One things with me is that these are smbd prcess that
are abnormaly high (10 processes with the same owner
from the same computer in 2 seconds)


After identifiing the original user that launch this
cascading smbd prcess starting, (the first listed with
a high amount of prcess of its own in doing a "ps
aux"), I just run "smbpasswd -d user" to unallow his
connection 'til I scan his files for viruses.


To conclude, as for you, I'm getting unable to kill
either smbd and nmbd process (even with
/etc/init.d/smb stop) and only a hard reset followed
by the traditionnal disk scan puts my server online
again.

info : RH 7.1, kernel 2.4.2 (2.4.16 ready but still
too fat :oP ), samba 2.2.2 (from samba.org rpm
pre-compiled distrib)


Hope you're feeling less alone,

cu

ioio

 --- "Gerald (Jerry) Carter" <jerry at samba.org> a
écrit : > On Tue, 8 Jan 2002, Andrew Bartlett wrote:
> 
> > Jurjen Oskam wrote:
> > >
> > > Hi,
> > >
> > > Just a quick question:
> > >
> > > is it normal to have 101 nmbd processes running
> on a relatively small Win2k
> > > network (about 7 clients)?
> >
> > No.  Nmbd doesn't do a per-client fork(), so there
> should only ever be
> > one process...
> 
> Or two if (wins support = yes).
> 
> > I think somthing is broken...
> 
> Definitley right about that....

___________________________________________________________
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
Yahoo! Courrier : http://courrier.yahoo.fr