回文章列表
作者sambas.bbs@ptt.cc (sambas) 看板: linux
標題[問題] CentOS 5 去攻擊別人,怎麼回事?
時間批踢踢實業 (2008/09/03 Wed 21:20:44)
請問一下,
我的CentOS5被區網警告了,

因為功力太弱,不懂這是什麼問題,
能否請前輩指點。
======================================================================
標題:myNetWatchman Incident
內容如下:
FYI,

Based on multiple reports from myNetWatchman users, we believe that the
following host is compromised or infected:

Source IP: My.CentOS.ip LastEvent: 2 Sep 2008 21:20:27 UTC
Time Zone: UTC

Event Date Time, Destination IP, IP Protocol, Target Port, Issue Description,
Source Port, Event Count
EventRecord: 2 Sep 2008 21:20:27, 61.192.x.x, 6, 80, Possible
Nachi/CodeRed/Nimda, 2810, 1
EventRecord: 30 Aug 2008 08:20:10, 69.123.x.x, 6, 80, Possible
Nachi/CodeRed/Nimda, 43204, 1
EventRecord: 30 Aug 2008 08:20:04, 69.123.x.x, 6, 80, Possible
Nachi/CodeRed/Nimda, 43204, 1
EventRecord: 30 Aug 2008 08:20:01, 69.123.x.x, 6, 80, Possible
Nachi/CodeRed/Nimda, 43204, 1
EventRecord: 28 Aug 2008 02:08:02, 65.6.x.x, 6, 3389, MS WBT Server , 2020, 1
EventRecord: 28 Aug 2008 00:40:22, 64.198.x.x, 6, 3389, MS WBT Server , 3029,
1
EventRecord: 27 Aug 2008 23:41:38, 64.115.x.x, 6, 3389, MS WBT Server , 3029,
1
EventRecord: 27 Aug 2008 23:21:02, 64.85.x.x, 6, 3389, MS WBT Server , 3029, 1
EventRecord: 27 Aug 2008 23:19:30, 192.168.x.x, 6, 3389, MS WBT Server ,
3029, 1
EventRecord: 27 Aug 2008 23:06:35, 64.65.x.x, 6, 3389, MS WBT Server , 3029, 1
EventRecord: 27 Aug 2008 23:04:43, 64.62.x.x, 6, 3389, MS WBT Server , 3029, 1
EventRecord: 27 Aug 2008 23:04:36, 64.62.x.x, 6, 3389, MS WBT Server , 3029, 1
EventRecord: 27 Aug 2008 22:48:11, 172.22.x.x, 6, 3389, MS WBT Server , 3029,
1
EventRecord: 27 Aug 2008 22:03:17, 63.246.x.x, 6, 3389, MS WBT Server , 4446,
1
EventRecord: 27 Aug 2008 22:03:17, 63.246.x.x, 6, 3389, MS WBT Server , 4446,
1
EventRecord: 27 Aug 2008 20:23:22, 63.105.x.x, 6, 3389, MS WBT Server , 4446,
1
EventRecord: 27 Aug 2008 20:23:22, 63.105.x.x, 6, 3389, MS WBT Server , 4446,
1
EventRecord: 27 Aug 2008 20:23:22, 63.105.x.x, 6, 3389, MS WBT Server , 4446,
1
EventRecord: 27 Aug 2008 19:59:42, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:59:42, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:59:42, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:59:42, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:59:41, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:59:41, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:59:41, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:59:41, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:59:41, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 19:54:31, 63.64.x.x, 6, 3389, MS WBT Server , 4446, 1
EventRecord: 27 Aug 2008 05:32:28, 60.241.x.x, 6, 3389, MS WBT Server , 3371,
1
EventRecord: 26 Aug 2008 18:54:07, 201.233.x.x, 6, 3389, MS WBT Server ,
4942, 1
EventRecord: 26 Aug 2008 16:45:30, 201.51.x.x, 6, 3389, MS WBT Server , 4942,
1
EventRecord: 26 Aug 2008 15:29:59, 201.29.x.x, 6, 3389, MS WBT Server , 4942,
1
EventRecord: 26 Aug 2008 06:46:22, 76.113.x.x, 6, 80, HTTP port probe, 50328,
1


Click here to get further details regarding this incident:
http://www.mynetwatchman.com/LID.asp?IID=4326227

If you are running Windows, you may be able to
use our SecCheck scanner to isolate the malware:
See: http://www.mynetwatchman.com/tools/sc



If you have any questions, feel free to contact me.

IMPORTANT: All replies to this e-mail are automatically posted
to a PUBLICLY viewable incident status.

If possible, please use the following URL to update incident status:


http://www.mynetwatchman.com/UI.asp?IID=4326227&GUID={5A314132-052D-48EE-8662-9C3164928CEB}

This allows us to efficiently communicate incident status to all interested
parties and minimizes the number of complaints you receive directly.

Please send PRIVATE communications to: support@mynetwatchman.com
Regards,

Lawrence Baldwin
Chief Forensics Officer
http://www.myNetWatchman.com
The Internet Neighborhood Watch
Atlanta, Georgia USA

--
  ╭─────────────────╥─────────────────╮
  Canon EOS 400D                  ╭╫╮Canon PowerShot S1 IS          
  EF-S 17-85mm F/4-5.6 IS USM    ╭╫╮ T-Link 0.48X Digital Wide Lens
  EF-S 55-250mm F/4-5.6 IS       ╭╫╮Canon IXUS 70                  
  EF-S 60mm F/2.8 Macro USM      ╭╫╮Canon A70                      
  ╘═════════════════╩═════════════════╝

--
※ 發信站: 批踢踢實業坊(ptt.cc) 
◆ From: 211.74.56.83
WolfLord:被入侵了啦                                             09/03 21:20
文章選讀←離開[主題上]主題下(k)上篇(j)下篇S/a搜尋 G串列 TAB精華 ↑↓捲 Pg/Space翻