RE: Unusual Activity

["irado () hotpop com" <irado () hotpop com>]

think that someone is trying to get these files from your machien.. maybe
you are now ´owned´ ;).

You said the ´come from´.. but where is it going to?

ps auxww --> to see whish (bash?) script is running now.. and use the
rootkit tool to examine your system :)




Original Message:
-----------------
From: Graydon McKee graydon.s.mckee.iv () orcmacro com
Date: Fri, 13 Feb 2004 11:45:28 -0500
To: security-basics () securityfocus com
Subject: Unusual Activity


Hello All, 
            I'm seeing some unusual activity.  One of our web servers it
sending emails via a
feedback page that proport to come from 333-333-3333test () test999 com. 
These messages have various
things in the From Field: 
 
From: "..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\boot.ini" <> 
From: "..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd" <> 
From: "\\\\'/bin/cat /etc/passwd\\\\'" <>
 


--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .



---------------------------------------------------------------------------
Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection

Protect your network with the comprehensive security solution that
integrates six applications for ease of use and lower TCO.

Firewall - Virus protection - Spam protection - URL blocking - VPN
- Wireless security.

Download 30-day evaluation at:
http://www.astaro.com/php/contact/securityfocus.php
----------------------------------------------------------------------------