Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:




Vulnerability Development mailing list archives

Re: Suspicious JOe.exe
From: "Sould3mon" <Sould3mon () killall net>
Date: Sat, 4 Aug 2001 05:28:26 +0200

i am on dalnet were simmelair  files are being sended on join of channels
these files are named <somthingto-do-with-sex>.mpeg.zip
in it there was 1 exe file
what i found in it was
inclear text

<ircserver> <port> <channel> <pass>  notice <nick> newvic

the actual line copy & pasted

...bind........backdoored.mine.nu 6667 #vics penile notice ntman newvics

this an other .exe  sended on dalnet to me
...bind.........ipz.mine.nu.6667.#ip.notice wicked.freshy

both irc servers do not exist not at the time i tested them
in this zobie version both were in clear text   i think the notice part
also counts for  the joe.exe
but it could be any msg :/
but in this version it came right after the network + port

( i do not know if anyone already mailed this 1  my first day in this mail
group i am sorry if it was)





  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]