Possible Virus infecting my Unix server - Unix

This is a discussion on Possible Virus infecting my Unix server - Unix ; I brought my floppy disk to the local unemployment job center yesterday and noticed a file ".nfsA69a44.4" in its directory. I have no idea how it got there, but my ibook running Mac OSX cannot see the file. I have ...

+ Reply to Thread
Results 1 to 13 of 13

Thread: Possible Virus infecting my Unix server

  1. Possible Virus infecting my Unix server

    I brought my floppy disk to the local unemployment job center yesterday
    and noticed a file ".nfsA69a44.4" in its directory. I have no idea how
    it got there, but my ibook running Mac OSX cannot see the file. I have
    not yet downloaded a replacement for Snitch nor NDE for Mac OSX,
    probably because I thought I did not need them, but perhaps I will. NDE
    and Snitch under Mac OS9 and earlier could see hidden files that the os
    could not. NDE for Mac OS9 does not seem to work in the Classic
    environment of OSX, so I will need a OSX native version. Snitch was
    never updated to work under OSX, so it looks like I will need to
    purchase another program that does. OSX may not use type/creator by
    default, but still OSX can read such files.

    Okay I inserted the resumes floppy into my ibook's USB drive, and
    uploaded the entire disk to my FTP space on my Unix shell account.

    But the file .nfsA69a44.4 appears in 2 directories on the server and
    will not go away. I have tried deleting them and they go away
    temporarily and then come back.

    John

    PS- THIS JUST IN. I tried deleting the directory Resumes on my server
    for the 6th time and this time the directory was successfully deleted
    without the message "The directory Resumes is in use" error message.
    Does anyone know why it took so long, and why the file .nfsA69a44.4 kept
    on reapearing after it was deleted?
    --
    John 1:6-9 There came a man who was sent from God;
    his name was John. He came as a witness to testify
    concerning that light, so that through him all men
    might believe. He himself was not the light; he came
    only as a witness to the light.
    CERM-Church Education Resource Ministries
    http://johnw.freeshell.org/bible/

    ----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
    http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
    ----= East and West-Coast Server Farms - Total Privacy via Encryption =----

  2. Re: Possible Virus infecting my Unix server

    "John the Baptist Jr." writes:

    > I brought my floppy disk to the local unemployment job center yesterday
    > and noticed a file ".nfsA69a44.4" in its directory.


    If a file which resides on a NFS server is opened by some application
    (e.g. word processor) and you delete it from a command line or somesuch, a
    file with a name .nfsXXXXXX (some strings) is created that keeps the
    context of that file. It has nothing to do with virii and all to do with a
    way NFS (network file system) works.

    HTH, Dragan


    --
    Dragan Cvetkovic,

    To be or not to be is true. G. Boole No it isn't. L. E. J. Brouwer

    !!! Sender/From address is bogus. Use reply-to one !!!

  3. Re: Possible Virus infecting my Unix server

    In article ,
    Dragan Cvetkovic wrote:

    > If a file which resides on a NFS server is opened by some application
    > (e.g. word processor)


    No such app opened it

    and you delete it from a command line or somesuch, a
    > file with a name .nfsXXXXXX (some strings) is created that keeps the
    > context of that file. It has nothing to do with virii and all to do with a
    > way NFS (network file system) works.
    >
    > HTH, Dragan


    I deleted it with Fetch (FTP) for OSX.


    John
    --
    John 1:6-9 There came a man who was sent from God;
    his name was John. He came as a witness to testify
    concerning that light, so that through him all men
    might believe. He himself was not the light; he came
    only as a witness to the light.
    CERM-Church Education Resource Ministries
    http://johnw.freeshell.org/bible/

    ----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
    http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
    ----= East and West-Coast Server Farms - Total Privacy via Encryption =----

  4. Re: Possible Virus infecting my Unix server



    Dragan Cvetkovic wrote:
    > "John the Baptist Jr." writes:
    >
    >
    >>I brought my floppy disk to the local unemployment job center yesterday
    >>and noticed a file ".nfsA69a44.4" in its directory.

    >
    >
    > If a file which resides on a NFS server is opened by some application
    > (e.g. word processor) and you delete it from a command line or somesuch, a
    > file with a name .nfsXXXXXX (some strings) is created that keeps the
    > context of that file. It has nothing to do with virii and all to do with a
    > way NFS (network file system) works.
    >
    > HTH, Dragan


    Right, so go find the process that has the original file open and kill
    it if you want to remove the .nfs file.

    Ed.

  5. Re: Possible Virus infecting my Unix server

    In article ,
    Ed Morton wrote:

    > Dragan Cvetkovic wrote:
    > > "John the Baptist Jr." writes:
    > >
    > >
    > >>I brought my floppy disk to the local unemployment job center yesterday
    > >>and noticed a file ".nfsA69a44.4" in its directory.

    > >
    > >
    > > If a file which resides on a NFS server is opened by some application
    > > (e.g. word processor) and you delete it from a command line or somesuch, a
    > > file with a name .nfsXXXXXX (some strings) is created that keeps the
    > > context of that file. It has nothing to do with virii and all to do with a
    > > way NFS (network file system) works.
    > >
    > > HTH, Dragan

    >
    > Right, so go find the process that has the original file open and kill
    > it if you want to remove the .nfs file.
    >
    > Ed.


    You think someone was hacking into my account?
    --
    John 1:6-9 There came a man who was sent from God;
    his name was John. He came as a witness to testify
    concerning that light, so that through him all men
    might believe. He himself was not the light; he came
    only as a witness to the light.
    CERM-Church Education Resource Ministries
    http://johnw.freeshell.org/bible/

    ----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
    http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
    ----= East and West-Coast Server Farms - Total Privacy via Encryption =----

  6. Re: Possible Virus infecting my Unix server

    Begin
    On 2006-01-26, John the Baptist Jr. wrote:
    >> Right, so go find the process that has the original file open and kill
    >> it if you want to remove the .nfs file.

    >
    > You think someone was hacking into my account?


    He says no such thing.

    I think you'll be better off if you put some effort into understanding
    what is going on. Currently you're being both uninformed and paranoid.
    You can try and be the latter again if you made sure you stopped being
    the former. Until then, you probably should not worry about things you
    do not know how to fix. Otherwise it is just your health that suffers.

    The quick way out, of course, is not using computers at all, and hope
    that the people that do use them, know what they're doing.


    --
    j p d (at) d s b (dot) t u d e l f t (dot) n l .
    This message was originally posted on Usenet in plain text.
    Any other representation, additions, or changes do not have my
    consent and may be a violation of international copyright law.

  7. OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server

    On comp.unix.questions, in , "John the Baptist Jr." wrote:



    > --
    > John 1:6-9 There came a man who was sent from God;
    > his name was John. He came as a witness to testify
    > concerning that light, so that through him all men
    > might believe. He himself was not the light; he came
    > only as a witness to the light.
    > CERM-Church Education Resource Ministries
    > http://johnw.freeshell.org/bible/
    >


    Typical psuedo-Christian: Doesn't have to follow the rules
    that everyone else follows because God is on his side.

    Like the 4-line Netiquette limit on sigs (yours includes the
    garbage below, so you are _seriously_ out of line).


    > ----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
    > http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
    > ----= East and West-Coast Server Farms - Total Privacy via Encryption =----



    And you'd think that someone with God on their side could come
    up with a few bucks for an account on a newsserver rather than
    having to use a (free) spam-sigging server that even most trolls
    won't touch.


    I'd be willing to bet that John the Baptist would have a few
    stern words to say about you adopting his name.

    Like: "Quit making me look bad!"

    Alan

    --
    http://home.earthlink.net/~alanconnor/contact.html
    see also: links.html and newsfilter.html
    Other URLs of possible interest in my headers.

  8. Re: OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server

    In article ,
    Alan Connor wrote:

    > Typical psuedo-Christian: Doesn't have to follow the rules
    > that everyone else follows because God is on his side.


    Rom. 13:1 Everyone must submit himself to the governing authorities,
    for there is no authority except that which God has established. The
    authorities that exist have been established by God.

    >
    > Like the 4-line Netiquette limit on sigs (yours includes the
    > garbage below, so you are _seriously_ out of line).


    2Tim. 4:2 Preach the Word; be prepared in season and out of season;
    correct, rebuke and encourage with great patience and careful
    instruction.

    Everywhere I go the gospel will follow. I am sorry it offends you, but
    this was prophised long ago and you my friend are a fulfillment of that
    prophecy.

    >
    > > ----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet
    > > News==----
    > > http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+
    > > Newsgroups
    > > ----= East and West-Coast Server Farms - Total Privacy via Encryption =----



    I have no idea why Newsfeeds.com posts this sig after every post. Why
    dont you ask them instead of complaining to me?

    >
    >
    > And you'd think that someone with God on their side could come
    > up with a few bucks for an account on a newsserver rather than
    > having to use a (free) spam-sigging server that even most trolls
    > won't touch.



    Newsfeeds cost me $6 or so a month for 1GB of downloads. Certainly
    superior to a ISP's Usenet feed. And some ISP's these days do not even
    provide usenet anymore. Some only provide web access. No pop3 and no
    Usenet.

    > > I'd be willing to bet that John the Baptist would have a few

    > stern words to say about you adopting his name.
    >
    > Like: "Quit making me look bad!"
    >
    > Alan



    John 10:27 My sheep listen to my voice; I know them, and they follow me.


    >
    > --


    ----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
    http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
    ----= East and West-Coast Server Farms - Total Privacy via Encryption =----

  9. Re: OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server

    On 2006-01-26, rambo wrote:
    > In article ,
    > Alan Connor wrote:
    >
    >> Typical psuedo-Christian: Doesn't have to follow the rules
    >> that everyone else follows because God is on his side.

    >
    > Rom. 13:1 Everyone must submit himself to the governing authorities,
    > for there is no authority except that which God has established. The
    > authorities that exist have been established by God.


    Are you reading this as saying that civil authority is illegitimate? My
    interpretation is that any government that is in power must have been
    approved by God (though looking at the world today, He's certainly
    working in more mysterious ways than usual), or it wouldn't be in power.

    > Everywhere I go the gospel will follow. I am sorry it offends you, but
    > this was prophised long ago and you my friend are a fulfillment of that
    > prophecy.


    All he's saying [though he's saying it in a somewhat rude way - probably
    frayed nerves from seeing all the crap from televangelists/etc] is, try
    to limit your sig to 4 lines by 79 columns of gospel. If you need more,
    try a sig rotator to put a different quote in every post.

    > I have no idea why Newsfeeds.com posts this sig after every post. Why
    > dont you ask them instead of complaining to me?


    You're their paying customer, you ask them. Or take your business
    elsewhere.

    > Newsfeeds cost me $6 or so a month for 1GB of downloads. Certainly
    > superior to a ISP's Usenet feed. And some ISP's these days do not even
    > provide usenet anymore. Some only provide web access. No pop3 and no
    > Usenet.


    individual.net costs me EUR10 [$12.22 at the exchange rate when i paid
    last month] a year for unlimited text access [reading and posting].
    No binaries, but you could always subscribe to both services, and use
    individual for posting.

  10. Re: OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server

    On comp.unix.questions, in , "rambo" wrote:
    > Subject: Re: OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server
    > From: rambo
    > Date: Wed, 25 Jan 2006 21:23:24 -0800
    > Message-ID:
    > References:
    > Lines: 74
    > Organization: none
    > Path: newsspool1.news.pas.earthlink.net!stamper.news.pas .earthlink.net!elnk-nf2-pas!newsfeed.earthlink.net!newshub.sdsu.edu!nx01.i ad01.newshosting.com!newshosting.com!38.119.100.14 8.MISMATCH!news-out2.newsfeeds.com!local!sp6iad.superfeed.net!ramb o
    > Newsgroups: comp.unix.misc,comp.unix.questions
    > X-Proxy-User: $$$hg6n0tgj
    > User-Agent: MT-NewsWatcher/3.4 (PPC Mac OS X)
    > X-Report: Please report illegal or inappropriate use to . Forward a copy of ALL headers INCLUDING the body. (DO NOT SEND ATTACHMENTS)
    > X-Comments2: IMPORTANT: Newsfeeds.com does not condone,support,nor tolerate spam or any illegal or copyrighted postings.
    > X-Comments: This message was posted through Newsfeeds.com
    > Xref: news.earthlink.net comp.unix.misc:47517 comp.unix.questions:126394
    > X-Received-Date: Wed, 25 Jan 2006 21:23:52 PST (newsspool1.news.pas.earthlink.net)






    "rambo"? Nope. Just another dickless punk hiding behind the
    Internet and posting dung on the Usenet with his mommy's
    computer.

    You are obviously "John the Baptist Jr.", because your headers
    are almost identical to his.

    Jordan Abel is you too. Individual.net
    and a gmail address.

    I _knew_ you were an effing troll.

    All three aliases are killscored here. This means that even if
    I score a thread for full downloads, the bodies of your posts
    will remain on the server.

    You are denied permission to send articles to my computer via
    the Usenet.

    My newsreader only downloads the headers unless I specifically
    tell it to do otherwise:

    http://slrn.sourceforge.net/docs/README.offline


    Alan

    --
    http://home.earthlink.net/~alanconnor/contact.html
    see also: links.html and newsfilter.html
    Other URLs of possible interest in my headers.

  11. Re: OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server

    On 2006-01-27, Alan Connor wrote:
    > On comp.unix.questions, in , "rambo" wrote:
    >> Subject: Re: OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server
    >> From: rambo
    >> Date: Wed, 25 Jan 2006 21:23:24 -0800
    >> Message-ID:
    >> References:
    >> Lines: 74
    >> Organization: none
    >> Path: newsspool1.news.pas.earthlink.net!stamper.news.pas .earthlink.net!elnk-nf2-pas!newsfeed.earthlink.net!newshub.sdsu.edu!nx01.i ad01.newshosting.com!newshosting.com!38.119.100.14 8.MISMATCH!news-out2.newsfeeds.com!local!sp6iad.superfeed.net!ramb o
    >> Newsgroups: comp.unix.misc,comp.unix.questions
    >> X-Proxy-User: $$$hg6n0tgj
    >> User-Agent: MT-NewsWatcher/3.4 (PPC Mac OS X)
    >> X-Report: Please report illegal or inappropriate use to . Forward a copy of ALL headers INCLUDING the body. (DO NOT SEND ATTACHMENTS)
    >> X-Comments2: IMPORTANT: Newsfeeds.com does not condone,support,nor tolerate spam or any illegal or copyrighted postings.
    >> X-Comments: This message was posted through Newsfeeds.com
    >> Xref: news.earthlink.net comp.unix.misc:47517 comp.unix.questions:126394
    >> X-Received-Date: Wed, 25 Jan 2006 21:23:52 PST (newsspool1.news.pas.earthlink.net)

    > "rambo"? Nope. Just another dickless punk hiding behind the
    > Internet and posting dung on the Usenet with his mommy's
    > computer.
    >
    > You are obviously "John the Baptist Jr.", because your headers
    > are almost identical to his.
    >
    > Jordan Abel is you too. Individual.net
    > and a gmail address.


    And completely different headers otherwise, different writing style,
    and, notably, NOT posting to agree with him.

    ****, I'm not even a christian.

    > I _knew_ you were an effing troll.
    >
    > Both aliases and an innocent bystander are killscored here. This means


    Fixed your spelling error on this line. Geez, you try to give someone
    the benefit of the doubt and you get branded as a sock puppet. Has
    usenet really fallen so far?

    > that even if I score a thread for full downloads, the bodies of your
    > posts will remain on the server.




    Someone quote this, I want him to see it.

    what an asshole.

  12. Re: OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server

    On 2006-01-27, Jordan Abel wrote:
    > On 2006-01-27, Alan Connor wrote:

    [snip]
    >
    >> I _knew_ you were an effing troll.
    >>
    >> Both aliases and an innocent bystander are killscored here. This means

    >
    > Fixed your spelling error on this line. Geez, you try to give someone
    > the benefit of the doubt and you get branded as a sock puppet. Has
    > usenet really fallen so far?


    No, AC has never risen above it. That why most readers have him
    killfiled and only see his drivel when people waste their time
    responding to him.

    >> that even if I score a thread for full downloads, the bodies of your
    >> posts will remain on the server.

    >
    >
    >
    > Someone quote this, I want him to see it.


    Why do you care?

    > what an asshole.


    No kidding!

    --
    Chris F.A. Johnson, author |
    Shell Scripting Recipes: | My code in this post, if any,
    A Problem-Solution Approach | is released under the
    2005, Apress | GNU General Public Licence

  13. Re: OT Rude Pseudo-Christians was: Re: Possible Virus infecting my Unix server

    On 2006-01-27, Chris F.A. Johnson wrote:
    > On 2006-01-27, Jordan Abel wrote:
    >> On 2006-01-27, Alan Connor wrote:

    > [snip]
    >>
    >>> I _knew_ you were an effing troll.
    >>>
    >>> Both aliases and an innocent bystander are killscored here. This means

    >>
    >> Fixed your spelling error on this line. Geez, you try to give someone
    >> the benefit of the doubt and you get branded as a sock puppet. Has
    >> usenet really fallen so far?

    >
    > No, AC has never risen above it. That why most readers have him
    > killfiled and only see his drivel when people waste their time
    > responding to him.


    ah. sorry, i'm new here. I've since read up about him - sorry for
    wasting your time.

    >>> that even if I score a thread for full downloads, the bodies of your
    >>> posts will remain on the server.

    >>
    >>
    >>
    >> Someone quote this, I want him to see it.

    >
    > Why do you care?


    I changed my mind, i don't - i guess my initial set of assumptions was
    wrong. [still, the fact that he accused me of being a sock puppet on no
    other basis than having posted in the same thread and being a gmail
    address / individual.net user, even though i did not even post to
    disagree with him or to support the other user, seems like a new low
    even for him]

    >> what an asshole.

    >
    > No kidding!


+ Reply to Thread