I am using ubuntu on my laptop with a EDGE connection. I have no computers on my LAN.
First time this happened as a coincidence when i left a folder shared after office on my laptop and found it infected. After that i have tried to reproduce the issue and everytime this happens:
If i share a folder with samba and Guest Read+Write (777) permissions, after some time (varies, sometime a couple hours, sometime more than that) i start seeing strange files as shown below:
-r-xr--r-- 1 nobody nogroup 0 2010-08-19 23:19 ctf
-rw-r--r-- 1 nobody nogroup 337103 2004-08-04 00:10 dnpdwh.exe
-r-xr--r-- 1 nobody nogroup 0 2010-08-20 05:45 khx
-r-xr--r-- 1 nobody nogroup 0 2010-08-19 20:14 khy
-rw-r--r-- 1 nobody nogroup 596628 2008-04-14 22:01 mzbxsv.exe
-rw-r--r-- 1 nobody nogroup 510302 2004-08-04 19:50 uxnpfo.exe
I can always delete them but they keep popping back, i don't know from where they come or even why.
[EDIT]: Issue was Samba listening on public IP and then with 777 i was inviting the un-initiated to my system who though it was windows and thus dropping by viruses. Fixed with modifying samba configuration to:
interfaces = 127.0.0.0/8 eth0 bind interfaces only = yes
Problem was evident from log entries in /var/log/samba/log.IP_HERE
It was also evident as Samba was using nobody and nogroup to write files in Publicly writable shares.