Interesting reading, to late now for any investigetions though. The server is down at the moment, will remove the NW-cable tomorrow an reboot and start to look into it. With best regards Tomas Larsson Sweden Verus Amicus Est Tamquam Alter Idem > -----Original Message----- > From: fedora-list-bounces@xxxxxxxxxx > [mailto:fedora-list-bounces@xxxxxxxxxx] On Behalf Of Gabe Warren > Sent: Wednesday, July 20, 2005 2:16 AM > To: For users of Fedora Core releases > Cc: users@xxxxxxxxxxxxxxxx > Subject: Re: Strange connection > > > Tomas Larsson wrote: > > >Doing a netstat on my server, I find a strange connection. > > > >It's a crond-job with Apache as owner, and it seems to go to an > >irc-server, called 193.110.95.1:ircd, "carouge.ch.eu.undernet.org", > >anyone that knows what this is?? > > > > > Do you have awstats installed? Check and see if you have any hidden > directories in /tmp. There is an awstats exploit that allows > uploads as > the apache user. I found a process running as apache called > init.d on > one of my servers. It too was initiaiting connections out to > IRC. The > EnergyMech irc bot was uploaded and executed from the > /tmp/.bin directory. > > This person has explained in detail his experience. > > http://www.angelar.com/~jeremy/computer/hacked.html > > Maybe this is what happened to you. > > gabe > > -- > fedora-list mailing list > fedora-list@xxxxxxxxxx > To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list >
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
