[Coco] OT: ISP SOS

[Mike Pepe]

Gene Heskett wrote:
> On Wednesday 25 July 2007, kevdig at hypersurf.com wrote:
>> I can't send outgoing mail. Mozilla 1.8 gives an SMTP connection refused
>> error (This was sent using one of those web mail things). My ISP suggested
>> I try:
>>
>> telnet smtpauth.hypersurf.com 25
>>
>> This gives:
>>
>> telnet: connect to address 209.237.0.12: Network is unreachable
>>
>> I can ping it. I am on dialup and both systems I tried are running Linux
>> 2.4.31 (PowerMac 8600 and Toshiba laptop). Other than nat and masquerade
>> there are no iptable rules/chains installed that I know of.
>>
>> More disturbing, when I added a record <file> option to pppd and did:
>>
>> telnet smtpauth.hypersurf.com
>>
>> and then disconnected I saw some strange content from pppdump <file>:
>>
>> rcvd
>> "\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\f8\91{Z\00\ff\d0
>> \11\a9\b2\00\c0O\b6\e6\fc\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00
>> \00\00\00\00\00\01\00\00\00\00\00\00\00\00\00\ff\ff\ff\ff\18\01\00\00
>> \00\00\0a\00\00\00\00\00\00\00\0a\00\00\00SYSTEM"
>> rcvd "\00\00\00\00\00\00#\00\00\00\00\00\00\00#\00\00\00ALERT\00\00\00\00\00
>>      \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00
>>      \00\00\00\c2\00\00\00\00\00\00\00\c2\00\00\00     STOP! IMMEDIATE
>> ATTEN TI"
>> rcvd "ON REQUIRED\0a\0a   Windows has found "
>> time  0.1s
>> rcvd "CRITICAL SYSTEM ERRORS.\0a\0a Download Registry Clean"
>> rcvd "er from: www.key32.com\0a\0aFAILURE TO ACT NOW MAY LEAD TO DATA LOSS
>> AN D CORRUPTION!\0a\0a\00\00\00\00\00\00\f7\a4~"
>>
>> Any suggestions welcome. My ISP thinks my systems are screwed up?
>>
>> kevin
>>
> www.key32.com, IIRC is a virii site.  He's right I believe.
> 
> That is disturbing in that the signs all point to the machine being 
> compromised, possibly by a botnet infection.
> 
> First is to unplug the phone line so it can't do any more damage.
> 
> Copy off anything personal to some other storage media, and re-install, then 
> make sure the first thing is an update to the latest patches.
> 
> Or switch to linux.
> 

Yep, you've been hax0r3d.

Time to reinstall!