Full Disclosure mailing list archives
AW: AMDPatchB & InstallStub
From: "Michael Linke" <ml () intract org>
Date: Thu, 18 Sep 2003 00:24:52 +0200
Hello -phlox, I wrote the message to the list after I removed the process on this machine, so it is not more running there. The registry keys are removed by hands so the machine is clean since hours. Now I will write an email to United Colocation to tell them what is running on 63.246.134.50... Regards, Michael _____________________ -----Ursprüngliche Nachricht----- Von: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] Im Auftrag von phlox Gesendet: Mittwoch, 17. September 2003 22:34 An: full-disclosure () lists netsys com Betreff: Re: [Full-Disclosure] AMDPatchB & InstallStub We all learn somewhere... that is a IRC server, in which hosts drones.. to be used to DDOS other servers, companies, and what not, or be used in other manners.. which are probabaly not wanted by you.. so now there is a bot on your computer running and connecting to 63.246.134.50. I would contact owner of 63.246.134.50, you can check arin.net for that.. get that taken down.. and then I would remove the bot from your system.. get hackereliminator.. or something to remove the registery keys and the process running on your system.. -phlox ----- Original Message ----- From: "Michael Linke" <ml () intract org> To: <full-disclosure () lists netsys com> Sent: Wednesday, September 17, 2003 12:05 PM Subject: [Full-disclosure] AMDPatchB & InstallStub
At one of our Computers with Internet Access, I found a strange program running. amdpatchB.exe(38 KB) This program is trying to get Internet Access while starting. amdpatchB.exe is connecting 63.246.134.50:9900. There is a text based protocol running on 63.246.134.50 at a service on
port
9900. See Telnet output: ________________________________________________________ telnet 63.246.134.50 9900 Trying 63.246.134.50... Connected to 63.246.134.50. Escape character is '^]'. NOTICE AUTH :*** Looking up your hostname NOTICE AUTH :*** Checking Ident NOTICE AUTH :*** Found your hostname help :Drones2.newiso.org 451 * :Register first. _________________________________________________________ I used Google to look for this filename but got no result. Any ideas what this is? Regards, Michael _____________________ -----Ursprüngliche Nachricht----- Von: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] Im Auftrag von Richard Johnson Gesendet: Mittwoch, 17. September 2003 17:48 An: full-disclosure () lists netsys com Betreff: [Full-Disclosure] Re: openssh remote exploit In article <20030917132443.GA17620 () SDF LONESTAR ORG>, petard <petard () sdf lonestar org> wrote:An exploit would certainly constitute such evidence. Have you seen anything that indicates this bug is exploitable?I'm beginning to suspect that compromises attributed to this bug on Linux hosts were coincidental. They could have happened via exploits of other problems. That's because no-one has any forensics data or logs that indicate this particular bug as an attack route. However, the chance is not worth taking in practice, so upgrade time it is. Richard -- My mailbox. My property. My personal space. My rules. Deal with it. http://www.river.com/users/share/cluetrain/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: openssh remote exploit, (continued)
- Re: openssh remote exploit Peter Busser (Sep 19)
- Re: openssh remote exploit petard (Sep 16)
- Re: openssh remote exploit Darren Reed (Sep 16)
- Re: openssh remote exploit Blue Boar (Sep 16)
- Re: openssh remote exploit Richard Johnson (Sep 17)
- Re: openssh remote exploit petard (Sep 17)
- Re: openssh remote exploit Shawn McMahon (Sep 17)
- Re: openssh remote exploit Richard Johnson (Sep 17)
- AMDPatchB & InstallStub Michael Linke (Sep 17)
- Re: AMDPatchB & InstallStub phlox (Sep 17)
- AW: AMDPatchB & InstallStub Michael Linke (Sep 17)
- Re: AW: AMDPatchB & InstallStub Jordan Wiens (Sep 17)
- SV: AMDPatchB & InstallStub Peter Kruse (Sep 17)
- AW: AMDPatchB & InstallStub Michael Linke (Sep 17)
- Re: AMDPatchB & InstallStub S G Masood (Sep 17)
- Re: AMDPatchB & InstallStub Chris Ruvolo (Sep 17)
- Re: AMDPatchB & InstallStub S G Masood (Sep 17)