| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
From: chris+fulldisc at ruvolo.net (Chris Ruvolo) Subject: AMDPatchB & InstallStub On Wed, Sep 17, 2003 at 09:05:33PM +0200, Michael Linke wrote: > This program is trying to get Internet Access while starting. > amdpatchB.exe is connecting 63.246.134.50:9900. > There is a text based protocol running on 63.246.134.50 at a service on port > 9900. > See Telnet output: > ________________________________________________________ > NOTICE AUTH :*** Looking up your hostname > NOTICE AUTH :*** Checking Ident > NOTICE AUTH :*** Found your hostname This is an IRC server. It looks like your machine is now part of some kind of bot network. Any indication of how the machine was compromised? ωνω [local users on irc(3240)] 100% ωνω [global users on irc(3236)] 100% ωνω [invisible users on irc(4)] 0% ωνω [ircops on irc(3)] 0% ωνω [total users on irc(3240)] ωνω [unknown connections(8)] ωνω [total servers on irc(1)] (avg. 3240 users per server) ωνω [total channels created(7)] (avg. 462 users per channel) Channel Users Topic #use 3 #yes2 1 #a 2217 #amernnq 32 #abcdefg 32 #proxy 2 #a has bunch of clients with random names: [ eifefs ] [ ssdbw ] [ luwbx ] [ niiopk ] [ iuuvcr ] [ wkmcyh ] [ hxsdxj ] [ dwyfe ] [ mmfok ] [ hiqhn ] [ guiq ] [ ijgym ] [ dyhvq ] [ wyuo ] [ lwyo ] [ deii ] [ mlosw ] [ lpmblg ] [ jfybwz ] [ czyna ] [ ptyqm ] [ gbxn ] [ eqpabg ] [ jqmk ] [ klnzuu ] And random idents: #a nefgg H ituko@...-HSE-ppp202529.qc.sympatico.ca (nefgg) #a fywu H xsjt@...-218-229-14.red.bezeqint.net (fywu) #a dmwt H yfgjm@...onto-HSE-ppp3889996.sympatico.ca (dmwt) #a dggssb H iupvqu@...onto-HSE-ppp3698157.sympatico.ca (dggssb) #a zaovrf H sncbi@...uilly-103-1-2-82.w80-11.abo.wanadoo.fr #a jlhiqz H wmnxy@...t-216-76-249-3.pns.bellsouth.net (jlhiqz) #a fqpb H oernsholt@...B6D32.rev.stofanet.dk (fqpb) #a myuckz H nrne@...l-68-74-222-106.dsl.dytnoh.ameritech.net Hope this helps. -Chris -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 232 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030917/422b962b/attachment.bin
Powered by blists - more mailing lists