full-disclosure - AMDPatchB & InstallStub

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: phlox at comcast.net (phlox)
Subject: AMDPatchB & InstallStub

We all learn somewhere... that is a IRC server, in which hosts drones.. to
be used to DDOS other servers, companies, and what not, or be used in other
manners.. which are probabaly not wanted by you.. so now there is a bot on
your computer running and connecting to 63.246.134.50. I would contact owner
of 63.246.134.50, you can check arin.net for that.. get that taken down..
and then I would remove the bot from your system.. get hackereliminator.. or
something to remove the registery keys and the process running on your
system..

-phlox


----- Original Message ----- 
From: "Michael Linke" <ml@...ract.org>
To: <full-disclosure@...ts.netsys.com>
Sent: Wednesday, September 17, 2003 12:05 PM
Subject: [Full-Disclosure] AMDPatchB & InstallStub


> At one of our Computers with Internet Access, I found a strange program
> running.
> amdpatchB.exe(38 KB)
>
> This program is trying to get Internet Access while starting.
> amdpatchB.exe is connecting 63.246.134.50:9900.
> There is a text based protocol running on 63.246.134.50 at a service on
port
> 9900.
> See Telnet output:
> ________________________________________________________
> telnet 63.246.134.50 9900
> Trying 63.246.134.50...
> Connected to 63.246.134.50.
> Escape character is '^]'.
> NOTICE AUTH :*** Looking up your hostname
> NOTICE AUTH :*** Checking Ident
> NOTICE AUTH :*** Found your hostname
> help
> :Drones2.newiso.org 451 *  :Register first.
> _________________________________________________________
>
> I used Google to look for this filename but got no result.
> Any ideas what this is?
>
> Regards,
> Michael
> _____________________
>
> -----Urspr?ngliche Nachricht-----
> Von: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com] Im Auftrag von Richard
> Johnson
> Gesendet: Mittwoch, 17. September 2003 17:48
> An: full-disclosure@...ts.netsys.com
> Betreff: [Full-Disclosure] Re: openssh remote exploit
>
> In article <20030917132443.GA17620@....LONESTAR.ORG>,
>  petard <petard@....lonestar.org> wrote:
>
> > An exploit would certainly constitute such evidence. Have you seen
> > anything that indicates this bug is exploitable?
>
>
> I'm beginning to suspect that compromises attributed to this bug on
> Linux hosts were coincidental.  They could have happened via exploits
> of other problems.  That's because no-one has any forensics data or
> logs that indicate this particular bug as an attack route.
>
> However, the chance is not worth taking in practice, so upgrade time it
> is.
>
>
> Richard
>
> -- 
> My mailbox. My property. My personal space. My rules. Deal with it.
>                         http://www.river.com/users/share/cluetrain/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>