Saw something similiar in a FreeBSD box once. It was a trojan ftp daemon that started off some obscure user like sysgetty or some other "official" looking name. The RAID had 36 gigs of mp3s and porn.
You might want to backup your data and reinstall if no-one has a more knowledgable answer. In the meantime there's no need to disconnect from the net. Just have a rolling kill command that kills ftpd every second. I don't have shell skills yet but in dos it would be 2 files killa.bat and killb.bat killa.bat says killall ftpd and call killb.bat and killb does the same in reverse. I know someone must have a neat shell script that does this? -- Patrick "No sig in my .sig" Kirk GSM: +44 7876 560 646 ICQ: 42219699
