[Zeffie-Users] CTT spam ridden files?

[Zeffie.net Users List]

>>>> Hi Folks,
>>>>
>>>> I think this box is rooted. Or a daemon is doing something I can't
>>>> expain.
>>>> <snip>
>>>
>>> Hmm cant say i have. Anything unusual if you do a 'ps ax'?
>>
>> No, nothing special :( , lsof didn't say much either.
>>
>> That being said, I'm gonna run lsof and ps around 8 am when the files
>> were created.
>
> Ok anythin i can do you can MSN me steve at poundbury.com
>
> I like a nice challenge ;)

Thanks , I think I'll beable to get this, just hacked up a watch dog.

#!/bin/sh

LSOF=`/usr/sbin/lsof |/bin/grep -i CTT`
if [ "$LSOF" != "" ];
then
   echo $LSOF | /bin/mail -s 'CTT on pollerhost' "jeff at interchange.ca"
fi