On Wed, Sep 17, 2003 at 09:05:33PM +0200, Michael Linke wrote: > This program is trying to get Internet Access while starting. > amdpatchB.exe is connecting 63.246.134.50:9900. > There is a text based protocol running on 63.246.134.50 at a service on port > 9900. > See Telnet output: > ________________________________________________________ > NOTICE AUTH :*** Looking up your hostname > NOTICE AUTH :*** Checking Ident > NOTICE AUTH :*** Found your hostname This is an IRC server. It looks like your machine is now part of some kind of bot network. Any indication of how the machine was compromised? ωνω [local users on irc(3240)] 100% ωνω [global users on irc(3236)] 100% ωνω [invisible users on irc(4)] 0% ωνω [ircops on irc(3)] 0% ωνω [total users on irc(3240)] ωνω [unknown connections(8)] ωνω [total servers on irc(1)] (avg. 3240 users per server) ωνω [total channels created(7)] (avg. 462 users per channel) Channel Users Topic #use 3 #yes2 1 #a 2217 #amernnq 32 #abcdefg 32 #proxy 2 #a has bunch of clients with random names: [ eifefs ] [ ssdbw ] [ luwbx ] [ niiopk ] [ iuuvcr ] [ wkmcyh ] [ hxsdxj ] [ dwyfe ] [ mmfok ] [ hiqhn ] [ guiq ] [ ijgym ] [ dyhvq ] [ wyuo ] [ lwyo ] [ deii ] [ mlosw ] [ lpmblg ] [ jfybwz ] [ czyna ] [ ptyqm ] [ gbxn ] [ eqpabg ] [ jqmk ] [ klnzuu ] And random idents: #a nefgg H ituko@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (nefgg) #a fywu H xsjt@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (fywu) #a dmwt H yfgjm@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (dmwt) #a dggssb H iupvqu@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (dggssb) #a zaovrf H sncbi@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx #a jlhiqz H wmnxy@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (jlhiqz) #a fqpb H oernsholt@xxxxxxxxxxxxxxxxxxxxxxxx (fqpb) #a myuckz H nrne@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Hope this helps. -Chris
Attachment:
pgp00039.pgp
Description: PGP signature