-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Here's some info NSIT was able to provide. Begin forwarded message:

Hello Ti,

Although we cannot tell for sure, the attack appears to have been an SSH brute-force attack intially from a Russian IP address 213.85.77.92 that began around 2009-08-20 20:12hr CST.

Within about 10 minutes, it appears that a few files were downloaded onto 128.135.125.23: - W2Ksp3.exe from download.microsoft.com - gosh.tgz from mala69.ucoz.com, - eduard.tgz from linusovy.tripod.com

The SSH scanning begins directly after that in a sequential scan starting with 128.0.0.1.

Regards, Shelley

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkqO2vMACgkQ4RgdOxQVi0DYaACfUm4IY5u/JjhGVLaTl+y2Wr2P sRIAnjzMMkLkzDTUOUN4EpvlRwm3BiT7 =SBVs -----END PGP SIGNATURE-----