Possible virus from Rome labs

[rg () issi com (Ron Gilmer)]

I received this message from one of my users this morning, but have not been 
able to verify with him or Liz Keane as to the problem and what is really 
going on. (Liz is supposed to call me back around 3:00pm EST)

While I'm waiting for her call, checking all my systems and getting "more"
paranoid by the minute; I thought I would ask if anyone else has heard of this?? 

Once I get some more info, I'll post it.

BTW. Rome Labs has apparently pulled the plug and all their systems 
are showing up as "unknown host".

-rg-

  > Dear Sysadmin,
  > 
  > I just got a call from Liz Keane at Rome Labs.  Apparently they
  > have had a virus up there at Rome.  It may be passed through
  > ftp and we have ftp'd them some files lately.
  > She said the virus puts two files in some random place on your system.
  > The files are:
  > 
  > jnk.tmp
  > foosh
  > 
  > She also said to look at /bin/login.  It may be changed
  > and the time stamp untouched.
  > 
  > I have not read anything about such a virus.  Have you
  > heard of something like that?
  > 
  > 
  > Mitch.
  >