From mboxrd@z Thu Jan  1 00:00:00 1970
From: SoloCDM <deedsmis@aculink.net>
Subject: Re: What Is hosts2-ns
Date: Sun, 26 May 2002 09:00:38 -0600
Sender: linux-admin-owner@vger.kernel.org
Message-ID: <3CF0F896.470EAC14@cdm01.deedsmiscentral.net>
References: <200205251712.AA251134182@wcox.com>
Reply-To: deedsmis@aculink.net, linux-admin@vger.kernel.org
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Return-path: <linux-admin-owner@vger.kernel.org>
List-Id: <linux-admin.vger.kernel.org>
Content-Type: text/plain; charset="us-ascii"
To: David Jackson <david.jay.jackson@wcox.com>
Cc: "Linux-Administration (Majordomo)" <linux-admin@vger.kernel.org>

David Jackson stated the following:
> 
> > On Linux, what is hosts2-ns?  How is it accessed from a remote host?
> > Someone recently tried to access my server through port 81.
> 
> Accessed how?
> 
> telnet you_hostname 81
> http://www.your_hostname.com:81
> 
> Check /etc/services that's where port are assigned.  Post any related
> messages from logs.

The only other related part was the origin:
yin.globalmedia.org/129.250.225.10.  Portsentry caught it before any
damage could take place.

Another source said it is probably a new WinIIS worm.

-- 
Note: When you reply to this message, please include the mailing
      list/newsgroup address and my email address in To:.

*********************************************************************
Signed,
SoloCDM