Re: CGI form access

["kevin_orrey" <kevin_orrey () hotmail com>]

Rod,

Have a look at:

http://www.malwaredomainlist.com/mdl.php?search=91.213.174&colsearch=All&quantity=50

Alot of activity on the class C and the same trojan in quite a few cases, 
may give you pointers.  Looks like you have 3 beacon domains the malware is 
trying to report into for instructions possibly

Rgds

Kev Orrey
http://www.vulnerabilityassessment.co.uk

-----Original Message----- 
From: Rod
Sent: Thursday, January 27, 2011 5:58 PM
To: security-basics () securityfocus com
Subject: CGI form access

Hello,

I have a laptop I'm working on that is attempting to connect to a few
IP addresses (see below) in Russia anytime Internet Explorer or
Firefox is open. These IP addresses appear to be inactive at the
moment. I've scanned the laptop with 3 different AV applications and
malwarebytes. I've cleared the cookies and temporary Internet files.
The laptop still attempts to connect to them. Does anyone have any
ideas on what the infection might be and how to get rid of it?

Thanks,
Rod


h t t p://91. 217.249.130/cgi-bin/forms.cgi
h t t p://91. 213.174.41/cgi-bin/forms.cgi
h t t p://91. 213.174.40/cgi-bin/forms.cgi

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL 
certificate.  We look at how SSL works, how it benefits your company and how 
your customers can tell if a site is secure. You will find out how to test, 
purchase, install and use a thawte Digital Certificate on your Apache web 
server. Throughout, best practices for set-up are highlighted to help you 
ensure efficient ongoing management of your encryption keys and digital 
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------ 


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------