Printable View
I've been looking at the traffic in my wireless network and something checks the webpage login.fric.cn every more or less every minute, i went there and there is only a button that takes you to microsoft but I dont think it's a microsoft thing... Does anyone know what it is? thanks
Welcome to AO!
try going to start > run > cmd
and type 'netstat -a -b' and push enter... [minus the quotes] that will tell you your outbound connections and the executables associated with them... hope this helps...
westin
Another program that you can use is from mcrosoft called Port Reporter. This will install only as a service that will log all loaded files in memeory when a socket is opened. We use this as a tool to see what is happening to servers when they are sending out goofy packets.
Here is the MS webpage http://www.microsoft.com/downloads/d...displaylang=en
thanks a lot, I think I'll use Port Reporter since I don't think the socket keeps connected after it checks that website.
some additional sites resolve to the same IP
http://hphosts.mysteryfcm.co.uk/?s=login.fric.cn
and it appears on a blocked sites list here
http://www.ifls.lib.wi.us/about/tech...kedspyware.asp
i'd say your first step is to set your firewall to block inbound and connections to fric.cn
rule of thumb...anytime you see unexpected connection to servers in china (.cn) russis (.ru) and a bunch more ...i'd assume you are compromised in one fashion or another...
i'd get http://www.sophos.com/products/free-...i-rootkit.html and run it..
and I'd be running anti spyware of your choice (i recommend blink from eEye..it has found stuff nothing else found...it's about 50 bucks but also prevents phishing, and -prevents- spyware, not just detecting and removing. Also protects against zero days
http://www.eeye.com/html/index.html
you can use command line utillity "fport"
This is the same information you would see using the 'netstat -an' command, but it also maps those ports to running processes with the PID, process name and path. Fport can be used to quickly identify unknown open ports and their associated
Hi there... That is indeed malware. I found that domain in one of my snort sigs.
That domain has been linked to Cool Web SearchQuote:
alert udp $HOME_NET any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fric.cn
"; content:"|04|fric|02|cn"; nocase; classtype:trojan-activity; reference:url,ww
w.bleedingsnort.com/blackhole-dns; sid:1033145; rev:1;)
http://www.bleedingsnort.com/forum/v...showtopic=1566
Download and run CWShredder in safe mode. (don't forget to disable system restore)
http://www.intermute.com/spysubtract..._download.html
BTW: It doesn't look as if the domain is still up and running...
When you went there... if you tried going there with IE and had your default search set to the microsoft search, they'll redirect you to a microsoft search site when the browser could not resolve the ip of the site. (because it appears to be down.)
fric.cn doesnt work but login.fric.cn does.
Not sure why... but I'm unable to resolve either login.fric.cn or fric.cn. No ping, no tracert, etc.Quote:
The only thing I can find is a little bit of whois info. Not much at all.
http://www.dnsstuff.com/tools/whois.ch?ip=fric.cn
http://www.samspade.org/t/lookat?a=fric.cn
When using IE, if you can't resolve the IP, IE will redirect you to your default search provider.
The default search provider is microsoft. (I have changed mine to google... so I get redirected to a google page.)
So, the reason you could be seeing microsoft when you try to visit that site is because you're being redirected. But, who knows. I don't have your eyes and can't see what you have on your screen.
I am using Firefox, maybe it only accepts some IP's...? If I telnet into port 80 and write something i get this:
HTTP/1.1 400 Bad Request
Date: Fri, 31 Aug 2006 12:34:32 GMT
Content-Length: 49
Connection: close
Content-Type: text/html; charset=iso-8859-1
Server: ********.embedded/0.9
<font size="+1"><b>400 - Bad Request</b></font>
I'll do a scan and post what I find
Perhaps you should concentrate on the machine that's causing the requests instead of trying to find out what the login.fric.cn host is?
As phish already pointed out.. It's probably linked to Cool Web Search.. Now go and clean that machine ;)
The (default) page does indeed show a form:
It's probably a stub. If you really want to know what it does take a closer look at the requests the infected machine is sending.. Fire up your favorite sniffer and capture that traffic..Code:dice@maelcum:~>nslookup login.fric.cn
Server: 2001:xxxx:yyyy:1::2
Address: 2001:xxxx:yyyy:1::2#53
Non-authoritative answer:
Name: login.fric.cn
Address: 64.71.167.64
dice@maelcum:~>nc 64.71.167.64 80
GET / HTTP/1.1
Host: login.fric.cn
HTTP/1.1 200 OK
Content-Length: 95
Content-Type: text/html
Server: ********.embedded/0.9
<FORM ACTION="http://www.microsoft.com" METHOD=POST>
<input type=submit value=" Go! ">
</FORM>
Whois on the IP shows it's owned by Hurricane Electric Internet Services.
Sirdice:
Thanks for that. I can get to that address, but can't resolve via dns.
Oh well, doesn't really matter anyway.
Yes, I've seen that it looks at that webpage everytime i connect to some webpage with IE, so its probably coolwebsearch or something simmilar, however, i'm curious about what it actually sends so I'll keep for some time to find out hehehe.