Most likely the reboot will clear out user mode worms, since they
don't actually compromise the system, just the user. The worm would
have needed to compromise teh system itself to write any startup
files. Though many bad applications wonk permissions on /Library/
StartupItems. All user files should be scrutinized so that they
don't have any login startup items that will restart it.
Thanks for the advice, Dan. As I mentioned to a couple of folks off-
list, it would be politically difficult to take down the server and
wipe/install, although it could be done if really necessary. For now,
simply removing the build of PsyBNC and the file stuck in /tmp seems
to have cleared up the problem. In the meantime, I'll continue
scanning the machine and users, plus monitor it, and should any other
funny business manifest, I'll force the client to let me rebuild the
box from scratch. <sigh>
Ted
--
Group D Communications
Technology Consulting -- IT, Databases, Software, Websites, Hosting
www.groupd.com
PH 415.701.8331
FX 415.701.8332
P.O. Box 170697
San Francisco, CA 94117-0697
