Re: traffico verso w8.dcx.yahoo.com - errata

hai provato a far girare un programma che elimini gli spyware?
----- Original Message ----- 
From: "lorenzo" <lorenzo@digitalmind.it>
To: <ml@sikurezza.org>
Sent: Monday, May 27, 2002 10:38 AM
Subject: Re: traffico verso w8.dcx.yahoo.com - errata


> NON era musicmatch jukebox, e` stato killato e il traffico continuava a
> girare. killando i programmi meno importanti uno a uno, il traffico si
> e` fermato quando abbiamo killato il programma SUPPORTER5.EXE che stava
> in \winnt\system32.
> l'ho parsato con 'strings' e tra le tante stringhe non leggibili
> compaiono:
> 
> [ricordo che il traffico era generato verso w8.dcx.yahoo.com come 
> syn ; syn-ack; ack; rst da parte del client che lanciava il primo syn, e
> ripetuto ogni 5 secondi]
> 
> ---
> 
> VeriSign Trust Network1
> VeriSign, Inc.1,0*
> #VeriSign Time Stamping Service Root1402
> +NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.0
> 970512000000Z
> 040107235959Z0
> VeriSign Trust Network1
> VeriSign, Inc.1,0*
> #VeriSign Time Stamping Service Root1402
> +NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.0
> h|,-.
> F=P4
> Western Cape1
>         Cape Town1
> Thawte Consulting cc1(0&
> Certification Services Division1
> Thawte Server CA1&0$
> server-certs@thawte.com0
> 011101232256Z
> 021101232256Z0
> Georgia1
> Atlanta1
> FreeTreeMedia.com, LLC1'0%
> Secure Application Development1
> FreeTreeMedia.com, LLC0\0
> www.eScorcher.com0
> n#m[
> ARp~&
> zm\ob
> VeriSign Trust Network1
> VeriSign, Inc.1,0*
> #VeriSign Time Stamping Service Root1402
> +NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.0
> 010228000000Z
> 040106235959Z0
> VeriSign, Inc.1
> VeriSign Trust Network1;09
> 2Terms of use at https://www.verisign.com/rpa (c)011'0%
> VeriSign Time Stamping Service0
> /oc 
> TBZze{
> 40200
> $http://ocsp.verisign.com/ocsp/status0  
> =0;09
> 0*0(
> https://www.verisign.com/rpa0
> Oc`,
> |z 02
> )]@U
> 6:9e
> Western Cape1
>         Cape Town1
> Thawte Consulting cc1(0&
> Certification Services Division1
> Thawte Server CA1&0$
> server-certs@thawte.com
> K[0H0V
> 1H0F
> http://www.eScorcher.com0
> @iJ,
> VeriSign Trust Network1
> VeriSign, Inc.1,0*
> #VeriSign Time Stamping Service Root1402
> +NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
> 
> ---
> 
> adesso proprio non capisco. e` un certificato? cosa c'entra con yahoo?
> se qualcuno vuole glielo posso mandare via e-mail, per analizzarlo...
> 
> saluti sempre piu` perplessi
> 
> 
> -- 
> 
> lorenzo
> lorenzo@digitalmind.it
> 
> 
> ________________________________________________________
> http://www.sikurezza.org - Italian Security Mailing List
> 
> 



________________________________________________________
http://www.sikurezza.org - Italian Security Mailing List