New Trojan?

[bytehd]

Uses UDP and TCP port 3386.
Which is listed in iana as GPRS-data (cell phone signalling)

Trouble is, EXPLORER.EXE is opening a connection to
151.25.34.63 which resolves to nice little names
Sam Spade gives me:
fbiserver.shacknet.nu
and
mazservercia.no-ip.org

my rDNS gives me a dial up italian:
ppp-63-34.25-151.libero.it

clues?

George Walkey
Senior Geek in charge

http://www.insyncva.com

 

[crow053]

Looking at mazservercia.no-ip.org, it could be a possble reverse connecting trojan. I would start doing trojan/virus scans.

 

[bytehd]

I did.
found a nice little bugger called ngrt.exe
gone


George Walkey
Senior Geek in charge

http://www.insyncva.com