Printable View
Today, while browsing around AO and looking at the hack attempts log, i saw this:
Activity: Qaz_Command
Source IP: 63.108.181.201 Source Port: 80
Destination IP: 211.100.0.34 Destination Port: 7597
Date & Time Code: 20011207190012
What the hell is a Qaz_Command? I have never seen an attempt of this kind made against AO. I'm just curious, as I have pretty much figured out what the other attempts have been, and have never seen this thing before...
Just learning;)
Ouroboros
Quit asking zelda.....:hello: Who knows
but anyways...;)Quote:
Originally posted by thor
Quit asking zelda.....:hello: Who knows
The old game Zelda....calm down man I was just joking:D I haven't seen this in the log's before either...
I found this on F-Secure's site...it's on other places too:
(snip)
This is network worm with backdoor capabilities, which spreads itself under Win32 systems. The worm was reported in-the-wild in July-August, 2000. The worm itself is Win32 executable file and about 120K long, written in MS Visual C++.
When an infected file is executed, the worm registers itself in Windows registry in auto-start section:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
startIE = "filename qazwsx.hsq"
where "filename" is the name of worm's file (usually this is "Notepad.exe", see below). As a result, the worm will be activated each time Windows starts up.
(/snip)