I am using ubuntu on my laptop with a EDGE connection. I have no computers on my LAN.
First time this happened as a coincidence when i left a folder shared after office on my laptop and found it infected. After that i have tried to reproduce the issue and everytime this happens:
If i share a folder with samba and Guest Read+Write (777) permissions, after some time (varies, sometime a couple hours, sometime more than that) i start seeing strange files as shown below:
-r-xr--r-- 1 nobody nogroup 0 2010-08-19 23:19 ctf
-rw-r--r-- 1 nobody nogroup 337103 2004-08-04 00:10 dnpdwh.exe
-r-xr--r-- 1 nobody nogroup 0 2010-08-20 05:45 khx
-r-xr--r-- 1 nobody nogroup 0 2010-08-19 20:14 khy
-rw-r--r-- 1 nobody nogroup 596628 2008-04-14 22:01 mzbxsv.exe
-rw-r--r-- 1 nobody nogroup 510302 2004-08-04 19:50 uxnpfo.exe
I can always delete them but they keep popping back, i don't know from where they come or even why.
[EDIT]: Issue was Samba listening on public IP and then with 777 i was inviting the un-initiated to my system who though it was windows and thus dropping by viruses. Fixed with modifying samba configuration to:
interfaces = 127.0.0.0/8 eth0
bind interfaces only = yes
in
/etc/samba/smb.conf
followed by
/etc/init.d/smbd restart
Problem was evident from log entries in /var/log/samba/log.IP_HERE
It was also evident as Samba was using nobody and nogroup to write files in Publicly writable shares.
nano ctf
also what directory is those file in. You better run rkhunter on your system for safety