IP 10.0.1.128:6667 Probing

[lieb39]

10.0.1.128:6667

Hello everyone,

It seems that something on my desktop computer is trying to connect to the computer 10.0.1.128 on port 6667. I do not have any IRC programs running, (I know that this is a IRC port)

Any infomation? I think it might be a trojan.

-lieb39

 

[Enyo]

Its trying to connect to a system a none-routeable internal IP

Probably a trojan or a worm.

Download active ports:

http://www.protect-me.com/freeware.html

Identify the process that is trying to connect.

Find the exe, ZIP the exe up and send it to me, ill identify it.

And finally rename the exe to say exe.virus until we know what is it.

 

[lieb39]

System32.exe, located in c:\windows\system32\system32.exe

Attached.

WARNING! DO NOT DOWNLOAD, MAY BE A VIRUS. ONLY FOR ENYO!

 

[Enyo]

Downloaded. Attachment Removed. Checking....

It is SdBot:

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.html

 

[lieb39]

Wow, that was fast. Thanks.

 

[Enyo]

No problem. Is it time to invest in a better AV?

 

[lieb39]

I actually have Norton Antivirus, I just don't run scans haha. I'm not sure how this one got through, probaly because Norton isn't all the time, it slows down my gaming haha.

Thanks,

-lieb39

 

[Enyo]

heh Okay. Keep that AV running lieb39! Or get one that does not take as much resources up (AVG)

 

[lieb39]

I guess I should. "Meh"