Backdoor/Subseven

One of my firewalls, on the internet connection, keeps shouting about
external access attempts from this Trojan and has done for a few days now.
BT provides a dynamic IP service so HTF does some **** keep picking me up?
I drop it several times a day.
The connection is tied down hard AFAIK.

 

It's me. I'm trying to hack your HD

--
cane [at] ukrm.org ¦ fireblade, r30
botafo t#50 f#03 YTC #15 bbb #6 pm #6 apostle [kotl] flo#12[with bar]
New? http://www.ukrm.net/faq/ukrmscbt.html
Rideout? http://www.horrible.demon.co.uk/botafof/
"Suckling the Mender"

 

Hemorrhoids?
Oooo I could do with some of that.

 

Someone else one the same subnet as you is infected and it's trying to
propagate.

I have a similar thing with cable, in fact the activity light is on
constantly these days, despite nothing coming through the firewall,
and no load.

 

Ah good thought! thanks

 

Ben wrote

Same on dial up.

I have to manually disconnect pretty much every connect from midday to
midnight these days.

 

In uk.rec.motorcycles, Hog said:

Someone is scanning a range of IP addresses and your just happens to be
in that range. Don't take it personally, if your firewall is blocking
them it's doing it's job

 

They don't. They just cycle through an address range.

 

Also possible of course

 

It seems to come from the same one several times then change.
Traceroutes have varied from Germany to the USA East coast.

 

Oh I'm annoyed now. Rebooted this machine and WTF...the admin password is
changed and the admin rights pulled from my superuser account. I'm VERY
annoyed. WTF is going on.

Fortunately I had the Linux based tools to change the W2000 passwords.