homepage Welcome to WebmasterWorld Guest from 54.211.47.170
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member
Home / Forums Index / WebmasterWorld / Webmaster General
Forum Library, Charter, Moderators: phranque & physics

Webmaster General Forum

    
What Is This?
Malware appeared on my floppy whilst uploading to FQ yesterday
Angonasec




msg:379151
 7:14 pm on Dec 14, 2004 (gmt 0)

I was shocked to see the following folders and files on my floppy disc today. I didn't put them there and I have no toolbars or junkware on my computer. I last used the disk to upload files to my website on a Win98 'puter. I use the free Agnitum firewall, and the only dodgy sites I visit, are suspicious ones showing in my logs. The latest was: www.atelebanon.com which may or may not having anything to do with this.

Here's the tree I saw on the floppy, none of the folders or files could be opened with an editor, and their properties were spurious. ie. massive GB files and dates set decades in the future

Folder: h my roo.t h
Folder: ood guy'.a

file: the MSI.ECr
file: .1" 403.306
file: .1; sv1;. .n
file: 2-05003]. "9
file: 6.78.90.--
file: ill conf.use
file: locking.cod

An updated Norton AV scan over it came up clean but I also noticed another file name appear in that scan:
/ovement.in

Updated Spybot scan also showed clean

I also have a Linux computer, but I think these files got on the disk whilst I was using the Win box, I'm not certain.

What is it? Where did it come from? How do I stop it happening?

Possibly connected: In another thread here, I'm asking how to stop my .htaccess code from banning MSIECrawler visitors, who currently get a 403 despite nothing in my .htaccess code causing this. I mention it becasue of the file names in the malware: file: the MSI.ECr and file: .1" 403.306

 

Dreamquick




msg:379152
 7:21 pm on Dec 14, 2004 (gmt 0)

Could of course just be a corrupted floppy disk which is mis-reporting its contents (hence the weird dates and incorrect file sizes).

Try getting windows to scan the disk fully for errors.

- Tony

Angonasec




msg:379153
 7:34 pm on Dec 14, 2004 (gmt 0)

You may be onto something there Tony, I'll do that after I get off this Linux box.

Having a look at those file names again, if you join them all together they could look like 'out-takes' from a text file I used to make my other recent WebmasterWorld post about unblocking MSIECrawler.

'Praps the floppy scrunged the lot together, and printed this on itself. It's currently tossed in a corner where my cat is playing with it.

Ta!

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / WebmasterWorld / Webmaster General
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved