mailing list archives
RE: what next
From: "Murda Mcloud" <murdamcloud () bigpond com>
Date: Wed, 7 Feb 2007 10:40:43 +1000
For me next would be determining how it got into your server. Was it from
outside or inside the perimeter? Can you see evidence of this 'access' in
your logs-firewall/server etc?
Any other files that were modified at the same time as that file was
Did it spawn any other exe's? Do you use the server for browsing-is it
necessary? How can you harden it? Is it patched and up to date with virus
defs? Was it actually an 'attacker' sitting at a console placing it on your
server or was it some drive by download?
Are there services that you could disable on the server that are
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of Justin
Sent: Wednesday, February 07, 2007 1:19 AM
To: nemanja.janic () centroproizvod co yu
Cc: security-basics () securityfocus com
Subject: Re: what next
nemanja.janic () centroproizvod co yu wrote:
i wasn't sure where to post this, and since i'm just starting out in
security, i figured that this is the place.
i've had a fine unknown gentleman enter at his will to my server; among
other things he left behind a file named tt (no extension) which contained
the following lines:
open 18.104.22.168 14547
user 1 1
open 22.214.171.124 5191
user 1 1
I figure this is some script to be used with ftp, or at least i think so.
I did tracert to those adresses, but that's where i'm stuck. What can i do
And any idea what that mstls.exe is? I deleted it, but it was 0 bytes in
Thanx in advance.
http://www.greatis.com/appdata/d/m/mstls.exe.htm -- Trojan/Backdoor
The file is an FTP script to StnyFtpd (for the ip address: 126.96.36.199).