How to Detect and Remove NetBus Worm from Server

[selfwebhosting]

I just got a notice from my datacenter saying that the NetBus worm has been found somewhere on my dedicated server using the following ports:

12345/tcp filtered NetBus
12346/tcp filtered NetBus

Just wonder if there is a way to detect which hosting account is having the NetBus worm. Does anyone know any tools out there?

How to close the ports that the worm is running at? Is this the way to temporarily disable the worm?

The datacenter says that if I do not detect and remove the worm, they will close down my server today :-(

WAHT SHOULD I DO???

 

[chatwizrd]

Use a program like clamav to scan files on the server.

 

[nobaloney]

A google search:

http://www.google.com/search?q=netb...ient=firefox&rls=org.mozilla:en-US:unofficial

gives a lot of information.

Since the netbus worm doesn't infect linux servers you may have some other kind of infection in your computer which is sending out the netbus worm.

Jeff