[Techtalk] rmserver, should I be worried?

[Beth Johnson]

On Tue, 2002-10-08 at 23:27, Jeannette wrote:
> I just walked past my RH 7.3 box (default (2.4.18-3) kernel, but behind a
> firewall) at 9:00 PM, and was concerned to hear it grinding away on
> something .... I ran top, and it said that a process called rmserver was
> using 98% of the CPU, and had used a total of 214 minutes of CPU time.

A quick google search turns up rmserver as a Real Media server.  Who
knows if that is the real process or not, but it's [any stuff named
rmserver is] certainly not part of any Red Hat install set that I know
of.

Being in /usr/local suggests something that was installed via a method
alternate to RPM, and a person is much more likely to remember something
that was installed without RPM I'd think.

I'd certainly consider the box compromised.

regards,
Beth
-- 
  /\/\    Beth Johnson
 / o o\   Cosmic Wonderer
( / ^^\)  Springfield, MA USA
 \ M_M/   "Ruling a country is like cooking a small fish--
           you have to handle it with care."--Lao Tzu