Cheese is a worm that is able to propagate from a Linux based system to another. It scans random Class B subnetworks for machines that are infected with a Lion worm, and if such systems are found, it copies itself to the victim to to directory "/tmp/.cheese".
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
When the worm executes, it removes all lines that contain string "/bin/sh" from the "/etc/inetd.conf" and restarts inetd service. This effectively removes an open shell installed by Lion worm.
After that Cheese will start to scan for other machines to infect.
Date Created: -
Date Last Modified: -