From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ryan Ngai Hon Kong Subject: RE: What Is hosts2-ns Date: Tue, 28 May 2002 08:59:54 +0800 Sender: linux-admin-owner@vger.kernel.org Message-ID: <75194D81CD3BD611B3CB00306E0114543BA6DF@JOSEXCHG> Mime-Version: 1.0 Return-path: List-Id: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: "'deedsmis@aculink.net'" , "'linux-admin@vger.kernel.org'" One of the trojan port listed on my lists said port 81 is RemoConChubo trojan. Good luck. Ryan -----Original Message----- From: SoloCDM [mailto:deedsmis@aculink.net] Sent: Sunday, May 26, 2002 11:01 PM To: David Jackson Cc: Linux-Administration (Majordomo) Subject: Re: What Is hosts2-ns David Jackson stated the following: > > > On Linux, what is hosts2-ns? How is it accessed from a remote host? > > Someone recently tried to access my server through port 81. > > Accessed how? > > telnet you_hostname 81 > http://www.your_hostname.com:81 > > Check /etc/services that's where port are assigned. Post any related > messages from logs. The only other related part was the origin: yin.globalmedia.org/129.250.225.10. Portsentry caught it before any damage could take place. Another source said it is probably a new WinIIS worm. -- Note: When you reply to this message, please include the mailing list/newsgroup address and my email address in To:. ********************************************************************* Signed, SoloCDM- To unsubscribe from this list: send the line "unsubscribe linux-admin" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html