[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Am I Compromised -- Some interesting findings



Hi Ritesh,
	my guess is as follows:
	you were hacked between 2005-11-20 and 2005-11-25.
	this installed a perl script. those .fuhrer* files are related to
	the hack and maybe useful as a signature of the attack.
	someone hosted on maple.phpwebhosting.com is the attacker or
	someone compromised this host and put those files there that
	were used to attack you. I would contact maple.phpwebhosting.com
	and tell them that you think someone with an account on there
	server attacked your computer with the username 'darkbroked'.
	Ask them if they can tell you anything and to keep you informed
	if they confirm that this user was the culprit. 
	cheers,
	Kev

-- 
counter.li.org #238656 -- goto counter.li.org and be counted!
      `$'         $'         
       $          $                      _
 ,d$$$g$  ,d$$$b. $,d$$$b`$' g$$$$$b $,d$$b
,$P'  `$ ,$P' `Y$ $$'  `$ $  "'   `$ $$' `$
$$     $ $$ggggg$ $     $ $ ,$P""  $ $    $
`$g. ,$$ `$$._ _. $ _,g$P $ `$b. ,$$ $    $
 `Y$$P'$. `Y$$$$P $$$P"' ,$. `Y$$P'$ $.  ,$.

Attachment: signature.asc
Description: Digital signature


Reply to: