[Full-disclosure] [Ticket#: 200505251001607] [SECURITY] rootkit/IRCbot on server adrians.lx.ro

[RESTENA NOC]

Dear Administrator of lx.ro, 
 
one of our customers has informed our staff that very 
recently an attack on one of his servers was performed 
that - after successfully gaining root rights - downloaded 
a malicious piece of software from the server 
 
adrians.lx.ro 
 
The exact file downloaded was: 
 
http://adrians.lx.ro/Robi.tar.gz 
 
and contains the psyBNC toolkit. This file is still 
present on that server. Please take the appropriate 
actions as soon as possible. 
 
Regards, 
 
RESTENA NOC 

 
---------------------------------------------------
Fondation RESTENA NOC
E-mail : noc at restena.lu                                   
Tel.   : +352 42 44 09 1
Fax    : +352 42 24 73