lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <57ae01c414d8$982e2930$192a2a52@server>
From: full-disclosure at dowd.co.uk (Steven Dowd)
Subject: backdoor irc

I need some help and wonder whether anyone can offer any to me

I believe I have had a system hacked/compromised, I have checked the system
and found these files,

c:\mIRC\Execs\Zfn4.exe

c:\mIRC\Execs\Die3nt.exe


I believe someone may have used to gain access into the system. It was a
patched win2k system.

I am looking for details on what these programs do, and how they are
activated or how control is gained through them



Symantec have the Zfn4.exe listed as Backdoor.IRC.Flood

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.flood.html

There website states "Backdoor.IRC.Flood is a backdoor Trojan. It installs
an mIRC client that has backdoor capabilities; this gives the hacker
unlimited access to the computer."




Pestcontrol lists the Die3nt.exe also as a trojan.

http://research.pestpatrol.com/Search/FileInfoResults.asp?MD5=f53a0574933fbed6740fef49cb76ff55




But I am having a few problems actually finding out anything else about the
files. has anyone any insight into how they work , what they do, how does a
person connect to a system via them. how far could a person get into the
system through these files, symantec seem quite clear that a hacker would
have unlimited access, but nowhere else can i find anything about this.






Thanks for your Time.




Steven Dowd


Powered by blists - more mailing lists