Re: CGI form access

[Adam Pal <pal_adam () gmx net>]

Hello Rod,


You could use Whatsrunning (http://www.whatsrunning.net/) to see which
process attempts to initiate the connection. (evtl. run as different
user)
Empty cookies and temporary files wont really help.
Try the software listed by Adrian.
Add eventually:
- Gmer
- Combofix

However it will take much more time to get the system clean than
installing a new one.
Might be the forms have been cleaned and the
malware did not noticed so still tries to access this source.


Best Regards,
Adam


Thursday, January 27, 2011, 6:58:33 PM, you wrote:

<==============Original message text===============
R> Hello,

R> I have a laptop I'm working on that is attempting to connect to a few
R> IP addresses (see below) in Russia anytime Internet Explorer or
R> Firefox is open. These IP addresses appear to be inactive at the
R> moment. I've scanned the laptop with 3 different AV applications and
R> malwarebytes. I've cleared the cookies and temporary Internet files.
R> The laptop still attempts to connect to them. Does anyone have any
R> ideas on what the infection might be and how to get rid of it?

R> Thanks,
R> Rod


R> h t t p://91. 217.249.130/cgi-bin/forms.cgi
R> h t t p://91. 213.174.41/cgi-bin/forms.cgi
R> h t t p://91. 213.174.40/cgi-bin/forms.cgi

R> ------------------------------------------------------------------------
R> Securing Apache Web Server with thawte Digital Certificate
R> In this guide we examine the importance of Apache-SSL and who
R> needs an SSL certificate.  We look at how SSL works, how it
R> benefits your company and how your customers can tell if a site is
R> secure. You will find out how to test, purchase, install and use a
R> thawte Digital Certificate on your Apache web server. Throughout,
R> best practices for set-up are highlighted to help you ensure
R> efficient ongoing management of your encryption keys and digital certificates.

R> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
R> ------------------------------------------------------------------------


<===========End of original message text===========



------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------