Re: CGI form access

[Rod <securitybasics () gmail com>]

Thanks, Mikhail. I'll have to try Kaspersky sometime. I have never
used it. I'm hoping what superantispyware found and removed will have
taken care of the problem. I'll have to wait until Monday to find out.

On Thu, Jan 27, 2011 at 4:31 PM, Mikhail A. Utin
<mutin () commonwealthcare org> wrote:
> Check processes before IE started and after. Then, you can check all port using netstat. It would show active 
> connections as well.
> However, crap stuff could be running all the time, so check in Task Manager all executables running.
> Then. Considering that it connects to Russia, install Kaspersky Lab AV/AMW software free trail version. It might be 
> aware of native stuff.
> The most important is the investigation using netstat with different options.
> Anyway, it should be a process running, try to catch it.
> If you aware of Nessus, you can install it on Linux computer and check your computer vulnerabilities. It also checks 
> for backdoors and other similar crap.
>
> Good luck.
>
>
> Mikhail A. Utin, CISSP
> Information Security Analyst
> Commonwealth Care Alliance
> 30 Winter St.
> Boston, MA
> TEL: (617) 426-0600 x.288
> FAX: (617) 249-2114
> http://www.commonwealthcare.org
> mutin () commonwealthcare org
>
> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Rod
> Sent: Thursday, January 27, 2011 12:59 PM
> To: security-basics () securityfocus com
> Subject: CGI form access
>
> Hello,
>
> I have a laptop I'm working on that is attempting to connect to a few
> IP addresses (see below) in Russia anytime Internet Explorer or
> Firefox is open. These IP addresses appear to be inactive at the
> moment. I've scanned the laptop with 3 different AV applications and
> malwarebytes. I've cleared the cookies and temporary Internet files.
> The laptop still attempts to connect to them. Does anyone have any
> ideas on what the infection might be and how to get rid of it?
>
> Thanks,
> Rod
>
>
> h t t p://91. 217.249.130/cgi-bin/forms.cgi
> h t t p://91. 213.174.41/cgi-bin/forms.cgi
> h t t p://91. 213.174.40/cgi-bin/forms.cgi
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------
>
> CONFIDENTIALITY NOTICE: This email communication and any attachments may contain confidential
> and privileged information for the use of the designated recipients named above. If you are
> not the intended recipient, you are hereby notified that you have received this communication
> in error and that any review, disclosure, dissemination, distribution or copying of it or its
> contents is prohibited. If you have received this communication in error, please reply to the
> sender immediately or by telephone at (617) 426-0600 and destroy all copies of this communication
> and any attachments. For further information regarding Commonwealth Care Alliance's privacy policy,
> please visit our Internet web site at http://www.commonwealthcare.org.

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------