Re: Trojan found on Linux server

[evilrabbi () securityfocus com, "[at]"@securityfocus.com, nopsled.net () securityfocus com]

This seems to be some retarded irc bot.
irc server: 64.239.9.236
irc port: 3434
server password: f9dsa

-
There are 87 users and 0 services on 1 servers
1 operators online
70 unknown connections
10 channels formed
I have 87 users, 0 services and 0 servers

64.239.9.236 -> goes to some christian website running phpnuke.

If you wanna know more load up a sniffer then execute the program as a NON ROOT user wait a bit kill the proccess then 
look at the sniffer logs.

-- evilrabbi --

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------------