Virus Modified Hosts File From My Honeypot

Full Version: Virus Modified Hosts File From My Honeypot

GovernmentSecurity.org > System Security > Beginners Section

easternerd

Aug 15 2005, 03:30 PM

Virus Modified Hosts file from my honeypot
hey guys,
just after a recent exploit in my honeypot and a routine checking in the hotspots came to see a modified hosts file.
Just take a look at the following listing, GSO website is blocked too,Lol i guess thats a new record of sorts !!
Hmm but it raises serious questions, which color hatted guy/gal would have wanted this to happen, i would love to hear if anyone else encountered this before me, and also your precious comments

QUOTE

127.0.0.1 localhost
127.0.0.1 updates1.kaspersky-labs.com
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.fastclick.net
127.0.0.1 ads.fastclick.net
127.0.0.1 ar.atwola.com
127.0.0.1 atdmt.com
127.0.0.1 avp.ch
127.0.0.1 avp.com
127.0.0.1 avp.ru
127.0.0.1 awaps.net
127.0.0.1 banner.fastclick.net
127.0.0.1 banners.fastclick.net
127.0.0.1 ca.com
127.0.0.1 click.atdmt.com
127.0.0.1 clicks.atdmt.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 download.microsoft.com
127.0.0.1 downloads.microsoft.com
127.0.0.1 engine.awaps.net
127.0.0.1 fastclick.net
127.0.0.1 f-secure.com
127.0.0.1 ftp.f-secure.com
127.0.0.1 ftp.sophos.com
127.0.0.1 go.microsoft.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 media.fastclick.net
127.0.0.1 msdn.microsoft.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 office.microsoft.com
127.0.0.1 phx.corporate-ir.net
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 sophos.com
127.0.0.1 spd.atdmt.com
127.0.0.1 support.microsoft.com
127.0.0.1 symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 vil.nai.com
127.0.0.1 viruslist.ru
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 www.avp.ch
127.0.0.1 www.avp.com
127.0.0.1 www.avp.ru
127.0.0.1 www.awaps.net
127.0.0.1 www.ca.com
127.0.0.1 www.fastclick.net
127.0.0.1 www.f-secure.com
127.0.0.1 www.kaspersky.ru
127.0.0.1 www.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.ru
127.0.0.1 ftp.kasperskylab.ru
127.0.0.1 ftp.avp.ch
127.0.0.1 www.kaspersky.ru
127.0.0.1 updates1.kaspersky-labs.com
127.0.0.1 updates3.kaspersky-labs.com
127.0.0.1 updates4.kaspersky-labs.com
127.0.0.1 updates2.kaspersky-labs.com
127.0.0.1 updates5.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 www.kaspersky-labs.com
127.0.0.1 updates3.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 www3.ca.com
127.0.0.1 ids.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 download.mcafee.com
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.governmentsecurity.org
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads-us2.kaspersky-labs.com
127.0.0.1 downloads-us3.kaspersky-labs.com
127.0.0.1 ftp.downloads2.kaspersky-labs.com

andydis

Aug 15 2005, 04:32 PM

lol, nice find, which virii did it show up as ? or was it un-named?

is this the whole list , or part of it? becuase i was going to say you would be okay if you had norman virus control download.norman.no doesnt seem to appear on the list ! lol.

Yorn

Aug 16 2005, 04:01 PM

Well, that sucks. I was just going to post a document about how to remove the worm sometime tonight. :/

GSecur

Aug 16 2005, 04:37 PM

Well isn't that a bit wierd? Who would think that we are that important int the first place?

Tec

Aug 16 2005, 10:46 PM

Could be a worm that monitors your browsing-activities and adding certain sites to the host file...

FiNaLBeTa

Aug 16 2005, 11:03 PM

QUOTE(GSecur @ Aug 16 2005, 04:37 PM)

Well isn't that a bit wierd? Who would think that we are that important int the first place?

I guess I'm thinking the same thing as you. Whoever wrote it is a member of this board.

easternerd

Aug 17 2005, 05:25 AM

QUOTE(Tec @ Aug 16 2005, 10:46 PM)

Could be a worm that monitors your browsing-activities and adding certain sites to the host file...

This is a standalone system, a newly installed win2k with just enough hardening to prevent outbound connections. nothing more , guess how zapped i was really !!
But yes this guy should be a member of this board.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.