From mboxrd@z Thu Jan 1 00:00:00 1970 From: SoloCDM Subject: Re: What Is hosts2-ns Date: Thu, 30 May 2002 13:03:17 -0600 Sender: linux-admin-owner@vger.kernel.org Message-ID: <3CF67775.F7D1A490@cdm01.deedsmiscentral.net> References: <75194D81CD3BD611B3CB00306E0114543BA6DF@JOSEXCHG> Reply-To: deedsmis@aculink.net, linux-admin@vger.kernel.org Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: List-Id: Content-Type: text/plain; charset="us-ascii" To: Ryan Ngai Hon Kong Cc: "Linux-Administration (Majordomo)" Ryan Ngai Hon Kong stated the following: > > One of the trojan port listed on my lists said port 81 is RemoConChubo > trojan. Where did you aquire a list of viruses -- what program? > -----Original Message----- > From: SoloCDM [mailto:deedsmis@aculink.net] > > David Jackson stated the following: > > >> On Linux, what is hosts2-ns? How is it accessed from a remote > >> host? Someone recently tried to access my server through port 81. > > > Accessed how? > > > telnet you_hostname 81 > > http://www.your_hostname.com:81 > > > Check /etc/services that's where port are assigned. Post any > > related messages from logs. > > The only other related part was the origin: > yin.globalmedia.org/129.250.225.10. Portsentry caught it before any > damage could take place. > > Another source said it is probably a new WinIIS worm. -- Note: When you reply to this message, please include the mailing list/newsgroup address and my email address in To:. ********************************************************************* Signed, SoloCDM