I was doing a quick scan for unusual files on my computer and came across autoexec.625. I tried to google it and only came up with one hit: "Index of /87/s874046" the address was student.wtuc.edu.tw/87/s874046/. The site was a file directory. I googled the site and came up with a bunch of sites in tawainese? After filetering for english only I came across some sites that seemed supicious to me. Here is the title of a couple:
1) Squid User's Access Report
2) proxy.ntu.edu.tw: Frequency of Access to remote sites
I went to the first site and it was a report of some sort. Here are the first few lines:
Squid User's Access Report
Period: 2003Mar19-2003Mar20
User: 210.70.243.3
Sort: bytes, reverse
User Report
The rest of the page contained a table:
The header:
ACCESSED SITE CONNECT BYTES %BYTES IN-CACHE-OUT USED TIME MILISEC %TIME
Content that followed:
emu.zbinfo.net 10 577.041.372 36.85% 0.00% 100.00% 06:22:01 22921578 49.72%
file.games.hinet.net 3 261.576.522 16.70% 0.00% 100.00% 00:50:17 3017029 6.54%
www.wfinfo.net.cn 2 151.320.999 9.66% 0.00% 100.00% 00:46:08 2768577 6.00%
and so on . . . for about a 100 or more sites.
I'm have hijack this but unfortunately I am on another computer right now so I cannot include the results. But I am right to be suspcious about this autoexec.625 considering what I came across in google. I'm not even really sure what it exatcly is I came across but it just looked suspicious.
Thanks for any help in advance,
Brad
