Re: traffico verso w8.dcx.yahoo.com - errata

NON era musicmatch jukebox, e` stato killato e il traffico continuava a
girare. killando i programmi meno importanti uno a uno, il traffico si
e` fermato quando abbiamo killato il programma SUPPORTER5.EXE che stava
in \winnt\system32.
l'ho parsato con 'strings' e tra le tante stringhe non leggibili
compaiono:

[ricordo che il traffico era generato verso w8.dcx.yahoo.com come 
syn ; syn-ack; ack; rst da parte del client che lanciava il primo syn, e
ripetuto ogni 5 secondi]

---

VeriSign Trust Network1
VeriSign, Inc.1,0*
#VeriSign Time Stamping Service Root1402
+NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.0
970512000000Z
040107235959Z0
VeriSign Trust Network1
VeriSign, Inc.1,0*
#VeriSign Time Stamping Service Root1402
+NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.0
h|,-.
F=P4
Western Cape1
        Cape Town1
Thawte Consulting cc1(0&
Certification Services Division1
Thawte Server CA1&0$
server-certs@thawte.com0
011101232256Z
021101232256Z0
Georgia1
Atlanta1
FreeTreeMedia.com, LLC1'0%
Secure Application Development1
FreeTreeMedia.com, LLC0\0
www.eScorcher.com0
n#m[
ARp~&
zm\ob
VeriSign Trust Network1
VeriSign, Inc.1,0*
#VeriSign Time Stamping Service Root1402
+NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.0
010228000000Z
040106235959Z0
VeriSign, Inc.1
VeriSign Trust Network1;09
2Terms of use at https://www.verisign.com/rpa (c)011'0%
VeriSign Time Stamping Service0
/oc 
TBZze{
40200
$http://ocsp.verisign.com/ocsp/status0  
=0;09
0*0(
https://www.verisign.com/rpa0
Oc`,
|z 02
)]@U
6:9e
Western Cape1
        Cape Town1
Thawte Consulting cc1(0&
Certification Services Division1
Thawte Server CA1&0$
server-certs@thawte.com
K[0H0V
1H0F
http://www.eScorcher.com0
@iJ,
VeriSign Trust Network1
VeriSign, Inc.1,0*
#VeriSign Time Stamping Service Root1402
+NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.

---

adesso proprio non capisco. e` un certificato? cosa c'entra con yahoo?
se qualcuno vuole glielo posso mandare via e-mail, per analizzarlo...

saluti sempre piu` perplessi


-- 

lorenzo
lorenzo@digitalmind.it


________________________________________________________
http://www.sikurezza.org - Italian Security Mailing List