Page 2 of 2 FirstFirst 12
Results 11 to 14 of 14
  1. #11
    Junior Member
    Join Date
    Aug 2006
    I'll do a scan and post what I find

  2. #12
    Just Another Geek
    Join Date
    Jul 2002
    Rotterdam, Netherlands
    Perhaps you should concentrate on the machine that's causing the requests instead of trying to find out what the login.fric.cn host is?

    As phish already pointed out.. It's probably linked to Cool Web Search.. Now go and clean that machine

    The (default) page does indeed show a form:

    dice@maelcum:~>nslookup login.fric.cn
    Server:         2001:xxxx:yyyy:1::2
    Address:        2001:xxxx:yyyy:1::2#53
    Non-authoritative answer:
    Name:   login.fric.cn
    dice@maelcum:~>nc 80
    GET / HTTP/1.1
    Host: login.fric.cn
    HTTP/1.1 200 OK
    Content-Length: 95
    Content-Type: text/html
    Server: ********.embedded/0.9
    <FORM ACTION="http://www.microsoft.com" METHOD=POST>
    <input type=submit value=" Go! ">
    It's probably a stub. If you really want to know what it does take a closer look at the requests the infected machine is sending.. Fire up your favorite sniffer and capture that traffic..

    Whois on the IP shows it's owned by Hurricane Electric Internet Services.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  3. #13
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Thanks for that. I can get to that address, but can't resolve via dns.
    Oh well, doesn't really matter anyway.
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  4. #14
    Junior Member
    Join Date
    Aug 2006
    Yes, I've seen that it looks at that webpage everytime i connect to some webpage with IE, so its probably coolwebsearch or something simmilar, however, i'm curious about what it actually sends so I'll keep for some time to find out hehehe.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

We have made updates to our Privacy Policy to reflect the implementation of the General Data Protection Regulation.