Re: Workstations trying to GET /download/IEService215.chm HTTP/1.1 fr om 67.109.249.3

[Paul Schmehl <pauls () utdallas edu>]

--On Friday, July 9, 2004 3:01 PM -0400 "Humes, David  G." 
<David.Humes () jhuapl edu> wrote:

> Starting around July 8th we noticed workstations trying to access
> 67.109.249.3 on port 80 and do a
>
> GET /download/IEService215.chm HTTP/1.1
>
> Analysis of the users' browsing activity did not reveal any pattern that
> would suggest that the activity was user-initiated.  We suspect that this
> is something trying to "phone home", but not sure quite what.  A reverse
> lookup of the IP just returns 67.109.249.3.ptr.us.xo.net, and whois just
> tells me that it belongs to XO.  Has anyone else seen this and know what
> it is?
In general, you can assume that machines downloading *.chm files have been 
compromised.  I downloaded the file, and used archmage to decompile it, but 
I don't see anything malicious looking in it.  However, it could be part of 
a complex system of file downloads that allows the attackers to control the 
machines.  I would *not* leave them on the network *unless* you can block 
that IP at your edge, and I would definitely start poking around for files 
and processes that don't belong on those machines *if* you have the time.

Otherwise I would reimage them.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu