Re: Strange connection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Tomas Larsson wrote:

Doing a netstat on my server, I find a strange connection.

It's a crond-job with Apache as owner, and it seems to go to an
irc-server, called 193.110.95.1:ircd, "carouge.ch.eu.undernet.org", anyone
that knows what this is??
Do you have awstats installed? Check and see if you have any hidden directories in /tmp. There is an awstats exploit that allows uploads as the apache user. I found a process running as apache called init.d on one of my servers. It too was initiaiting connections out to IRC. The EnergyMech irc bot was uploaded and executed from the /tmp/.bin directory.

This person has explained in detail his experience.

http://www.angelar.com/~jeremy/computer/hacked.html

Maybe this is what happened to you.

gabe


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux