i think an account hosted on a server has the MyPrettyWorm.perl inside. I think this is because of the latest bug from the phpbb forum. As soon as i enable the account a script is running ( -sh) and takes a lot of CPU. Also in the /tmp of the server i find folder /.bfos and a file called .bset Inside /.bfos are files like .myprettybot and .myprettyworm.
If i disable the account and cancell those files above in /tmp all is back. As soon as i enable the account all file i /tmp will be created again. Problem is that i couldn't fine any script that run the -sh command from that account. Is there any way to see wich script is running the -sh command and how to clean?
