[winxp] Backdoor utilizzata sul pc dell'università... aiuto [Archivio]

Rizzolo

31-01-2011, 20:35

Nel laboratorio dell'università abbiamo un pc che funge da server web, contiene un sito e una serie di programmi (creati da me) gestiti dal sito stesso.
Purtroppo mi è stata recapitata una mail dal nuovo servizio di monitoring delle risolse universitarie:

Backdoor - 137.204.201.129 - 2011-01-31 09:22 UTC [link_sito.it backdoor ftp port 54897(DE-RU) usata per scan... - macchina da SCOLLEGARE al più presto... - QUARANTINED]

Error returning browse list: NT_STATUS_ACCESS_DENIED
session request to 137.xxx.xxx.xxx failed (Called name not present)
session request to 137 failed (Called name not present)
Anonymous login successful
Domain=[WORKGROUP] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager]
Server Comment
--------- -------
Workgroup Master
--------- -------
Mon Jan 31 10:39:41 CET 2011

accessi backdoor(CET) from DE, RU :
T 2011/01/28 17:46:11.660377 88.153.81.126:55275 -> 137.xxx.xxx.xxx:54897 [AP]
USER scan..

T 2011/01/28 17:46:11.814299 88.153.81.126:55275 -> 137.xxx.xxx.xxx:54897 [AP]
PASS 4_pcc..

T 2011/01/28 17:56:01.116624 85.179.17.206:4896 -> 137.xxx.xxx.xxx:54897 [AP]
USER scan..

T 2011/01/28 17:56:01.199928 85.179.17.206:4896 -> 137.xxx.xxx.xxx:54897 [AP]
PASS 4_pcc..

T 2011/01/28 18:19:47.696428 81.177.159.133:2946 -> 137.xxx.xxx.xxx:54897 [AP]
USER scan..

T 2011/01/28 18:19:48.326163 81.177.159.133:2946 -> 137.xxx.xxx.xxx:54897 [AP]
PASS 4_pcc..

banner ftpbackdoor:
ftp> open 137.xxx.xxx.xxx 54897
Connected to 137.xxx.xxx.xxx.
220 .
504 Unknown security mechanism.
Name (137.xxx.xxx.xxx:gattosil1): scan
331 User oke, nu je pasje gnagna.
Password:
230 Goedzo, groetjes Punisher.
Remote system type is .
ftp> passive
Passive mode off.
ftp> dir
200 Succesvol commando.
150 Opening ASCII mode data connection for /bin/ls.
drw-rw-rw- 1 user group 0 Jan 28 18:06 .
drw-rw-rw- 1 user group 0 Jan 28 18:06 ..
-rw-rw-rw- 1 user group 20992 Jan 28 18:06 DFind_c2.exe
-rw-rw-rw- 1 user group 64501 Jan 28 18:02 Hoster.bat
-rw-rw-rw- 1 user group 54776 Jan 28 17:58 hide.exe
-rw-rw-rw- 1 user group 90112 Jan 28 18:06 javaw.exe
-rw-rw-rw- 1 user group 21504 Jan 28 17:56 kill.exe
-rw-rw-rw- 1 user group 197121 Jan 28 17:58 mspool.exe
-rw-rw-rw- 1 user group 540160 Jan 28 18:06 winloggon.exe
226 Transfer complete, Mod By Punisher
ftp> hash
Hash mark printing on (1024 bytes/hash mark).
ftp> prompt
Interactive mode off.
ftp> bi
200 Type set to I.
ftp> get Hoster.bat
local: Hoster.bat remote: Hoster.bat
200 Succesvol commando.
150 Opening BINARY mode data connection for Hoster.bat (64501 Bytes).
##############################################################
226 Transfer complete, Mod By Punisher
64501 bytes received in 0.018 seconds (3.6e+03 Kbytes/s)
ftp> quit
221 Mod By Punisher

$ cat Hoster.bat
$_scan.exe -p 1433 208.215.240.0 208.215.255.255 2500
$_scan.exe -p 1433 216.168.32.0 216.168.63.255 2500
$_scan.exe -p 1433 204.17.151.0 204.17.151.255 2500
$_scan.exe -p 1433 63.247.64.0 63.247.95.255 2500
$_scan.exe -p 1433 64.22.64.0 64.22.127.255 2500
$_scan.exe -p 1433 64.22.64.0 64.22.95.255 2500
$_scan.exe -p 1433 65.254.32.0 65.254.63.255 2500
$_scan.exe -p 1433 72.9.224.0 72.9.239.255 2500
$_scan.exe -p 1433 72.9.224.0 72.9.255.255 2500
$_scan.exe -p 1433 74.81.64.0 74.81.95.255 2500
$_scan.exe -p 1433 75.127.64.0 75.127.95.255 2500
$_scan.exe -p 1433 207.210.64.0 207.210.127.255 2500
$_scan.exe -p 1433 207.210.64.0 207.210.95.255 2500
$_scan.exe -p 1433 209.51.128.0 209.51.159.255 2500
$_scan.exe -p 1433 216.180.224.0 216.180.255.255 2500

Oltre a scollegare la macchina non mi è stato detto di più...
Potreste aiutarmi?
Cosa dovrei cercare?
Prima di domani non potrò effettivamente mettere mano sul pc incriminato, dite che sono fregato?

Grazie a tutti anticipatamente.