[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: What is this in my syslog????????

M-L wrote:

I have this in my syslog while downloading the latest updates from Debian?
My computer drops off the modem. the modem is still connected but ppp is not, the computer doesn't respond to being on the net/ 

I don't use chat and wonder if the machine is actually breached by intruders?

Charlie
Nov 6 17:59:41 taogypsy chat[7793]: Virus Infection and Unexpected Computer Shutdowns^M 
Nov  6 17:59:41 taogypsy chat[7793]: ^M
Nov  6 17:59:41 taogypsy chat[7793]: Affected Software: ^M
Nov  6 17:59:41 taogypsy chat[7793]: ^M
Nov  6 17:59:41 taogypsy chat[7793]: Microsoft Windows NT Workstation ^M
Nov  6 17:59:41 taogypsy chat[7793]: Microsoft Windows NT Server 4.0 ^M
Nov  6 17:59:41 taogypsy chat[7793]: Microsoft Windows 2000   ^M
Nov  6 17:59:41 taogypsy chat[7793]: Microsoft Windows XP  ^M
Nov  6 17:59:41 taogypsy chat[7793]: Microsoft Windows Win98   ^M
Nov  6 17:59:41 taogypsy chat[7793]: Microsoft Windows Server 2003^M
Nov  6 17:59:41 taogypsy chat[7793]: ^M
Nov  6 17:59:41 taogypsy chat[7793]: Non Affected Software: ^M
Nov  6 17:59:41 taogypsy chat[7793]: ^M
Nov  6 17:59:41 taogypsy chat[7793]: Microsoft Windows Millennium Edition^M
Nov  6 17:59:41 taogypsy chat[7793]: ^M
Nov 6 17:59:41 taogypsy chat[7793]: Your system is affected, download the patch from the address below ! ^M Nov 6 17:59:41 taogypsy chat[7793]: FIRST TYPE THE ADDRESS BELOW INTO YOUR INTERNET BROWSER, THEN CLICK 'OK 
Nov  6 17:59:41 taogypsy chat[7793]:  -- got it
Nov  6 17:59:41 taogypsy chat[7793]: send (ATDT0198308888^M)
Nov  6 17:59:41 taogypsy chat[7793]: expect (CONNECT)
Nov  6 17:59:41 taogypsy chat[7793]: '.^M
Nov 6 17:59:41 taogypsy chat[7793]: THE ADDRESS WILL DISAPPEAR ONCE YOU CLICK 'OK'.^M 
Nov  6 17:59:41 taogypsy chat[7793]: ^M
Nov 6 17:59:41 taogypsy chat[7793]: www.patchupdate.info^M
This looks a lot like your chatscript for the PPP connection has been overwritten by an e-mail about a virus or similar text message.
Very strange, but not quite enough to say the box is compromised -- it could simply be that the file somehow got overwritten with an errant cut and paste or similar.
Definitely worth checking into, though -- look into your /etc/ppp directory and associated files. Also, you don't mention which (if any) GUI-based dialer that you use, but it could be stored in a configuration file from one of those also -- again, likely an errant cut and paste or similar.
Go hunting with GREP to find the script or configuation file that contains one of the phrases from that chat log -- like "THE ADDRESS WILL DISAPPEAR" for example. Hunt the whole box if you have to, but you should be able to find out where that's coming from... 

Nate
Reply to: