[854] in resnet
Re: Port 18023 - more details/info
daemon@ATHENA.MIT.EDU (Denise Christenson)
Fri Feb 15 17:37:22 2002
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Message-ID: <sc6d4220.075@gwhub1>
Date: Fri, 15 Feb 2002 17:14:43 -0500
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Denise Christenson <christen@USNA.EDU>
To: RESNET-L@listserv.nd.edu
OK, it is definitely an mIRC bot/zombie.
To find out if any system has the bot/zombie installed on it, you can bring up a CMD prompt and type in the following:
netstat -an | find ":18023"
if it returns the following line:
TCP xxx.xxx.xx.xxx:xxxx xxx.xx.xxx.xxx:18023 ESTABLISHED
*fill in the x's with whatever ip you are coming from and reporting too :-)
...you should unplug it from the network and get rid of the files. (also tell the user to quit downloading from mIRC and users in general that they don't know)
Also, you may want to look for the following directory:
c:\winnt\system32\fonts
We found the file explorer.exe was in this directory and was the file that the bot is located in.
Also in this directory is a file called dead.ini with some interesting info in it, and a servers.txt file.
Cool stuff!!
Anyway, I hope no one else out there sees it, and gets a nastygram because one of their nodes is misbehaving, but it was really interesting to investigate.
Denise
Denise Christenson U. S. Naval Academy
Network Engineer Information Technology Services
"Few can foresee whither their road will lead them, till they come to its end."
-Legolas
>>> christen@USNA.EDU 02/15/02 03:11PM >>>
We have a node here that we were told participated with 99 other nodes in a DDoS attack against a system at another site.
The system was brought to my office, and as soon as I fired it up I checked and saw that it was connected to ip address 216.74.117.247 and listening on port 18023.
I think it is a bot/zombie on the system that caused this, but the kid has downloaded so many files from mIRC, I have no idea which one holds the bot. I'm just curious and trying to figure this out for future reference.
Anyone have any ideas on where I should start?
Thanks,
Denise
Denise Christenson U. S. Naval Academy
Network Engineer Information Technology Services
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
