Re: Possible virus from Rome labs

[bj () lv426 cc purdue edu (Ben Jackson)]

In message <9403301842.AA26529 () xyzzy issi com>, you wrote:
> I received this message from one of my users this morning, but have not been 
> able to verify with him or Liz Keane as to the problem and what is really 
> going on. (Liz is supposed to call me back around 3:00pm EST)
>
>   > The files are:
>   > 
>   > jnk.tmp
>   > foosh

Isn't `foosh' the name of the shell created by one of the rdist bug
exploit scripts?  I don't have access to the archive where I have those
particular files so I can't check, sorry.

--Ben