hsegtreas2
10 Sep 2006, 5:22am
I guess i plugged my laptop on the wrong network yesterday.. Now, when i plug in a network cable, it starts trying to connect to some computers on non-standard ports... the data sent/received isn't readable. i searched everywhere on the computer but i can't find anything suspicious.
Here's some of the computers of the botnet to which it is connecting, in case you'd be able to tell what rootkit/trojan is installed by seeing how it works:
128.59.104.142:3314
86.133.178.245:26048
24.184.158.241:24547
Some of these computers also have fake http and https servers open. A standard GET request will return a 501. Anything else will return the same data as on the other port.
I had windows XP firewall turned on, and also avaast "network shield" active. It seems both of these aren't too reliable :(
The most annoying part is that i'm unable to "see" the virus anymore in a network sniffer. Maybe it detected the zonealarm firewall that i just installed?
Thanks for any help :)
Here's some of the computers of the botnet to which it is connecting, in case you'd be able to tell what rootkit/trojan is installed by seeing how it works:
128.59.104.142:3314
86.133.178.245:26048
24.184.158.241:24547
Some of these computers also have fake http and https servers open. A standard GET request will return a 501. Anything else will return the same data as on the other port.
I had windows XP firewall turned on, and also avaast "network shield" active. It seems both of these aren't too reliable :(
The most annoying part is that i'm unable to "see" the virus anymore in a network sniffer. Maybe it detected the zonealarm firewall that i just installed?
Thanks for any help :)