From: "Keith R. Weiner" <keith@valiant.com>
To: Sundaram Ramasamy <sun@percipia.com>, netfilter@lists.netfilter.org
Subject: RE: some body hacked my system
Date: Tue, 8 Oct 2002 11:17:34 -0400 [thread overview]
Message-ID: <AF435BB1224A4C4888B58C546728EE323005@s2.valiant.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 1623 bytes --]
That looks like warcraft 3 if I had to take a guess. It is a very good game. Did you try unarchiving it?
You can block his ip address, but what is stopping this person from hitting you from another ip?
Look at your ftp server. Maybe disable anonymous logins. Maybe put quotas on. Maybe see if there are any patches to your ftp daemon.
What kind of ftp server are you using? WuFTPD, ms IIS, etc...?
I'm a newbie myself, but I'd just thought that I'd put in my 2 cents.
-----Original Message-----
From: Sundaram Ramasamy [mailto:sun@percipia.com]
Sent: Tuesday, October 08, 2002 11:08 AM
To: netfilter@lists.netfilter.org
Subject: some body hacked my system
Hi,
I am allowing ftp connection in my firewall, some body used ftp port, filled
my hard disk space. He logged-in from 68.65.58.159 IP (/var/log/message)
Oct 8 00:57:03 linux2 ftpd[25101]: FTP LOGIN FROM
va-staff-u1-c5a-159.frbgva.adelphia.net [68.65.58.159]
he created directory named WC3 and transfed follwoing files.
bash-2.04# cd WC3
bash-2.04# ls
wc3.part01.rar.gz wc3.part07.rar.gz wc3.part13.rar.gz wc3.part19.rar.gz
wc3.part02.rar.gz wc3.part08.rar.gz wc3.part14.rar.gz wc3.part20.rar.gz
wc3.part03.rar.gz wc3.part09.rar.gz wc3.part15.rar.gz wc3.part21.rar.gz
wc3.part04.rar.gz wc3.part10.rar.gz wc3.part16.rar.gz
wc3.part05.rar.gz wc3.part11.rar.gz wc3.part17.rar.gz
wc3.part06.rar.gz wc3.part12.rar.gz wc3.part18.rar.gz
Is anybody knows what this file used for?
How will i block this IP Address in my firewall?
How will i check what else he did on my machine?
Thanks
SR
[-- Attachment #2: Type: text/html, Size: 3435 bytes --]
next reply other threads:[~2002-10-08 15:17 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-08 15:17 Keith R. Weiner [this message]
2002-10-08 22:07 ` some body hacked my system Bob Sully
-- strict thread matches above, loose matches on Subject: below --
2002-10-08 17:17 Dominic Irrcher
2002-10-08 15:07 Sundaram Ramasamy
2002-10-08 15:24 ` Vito Louis Sansevero
2002-10-08 15:41 ` Carlos E Gorges
2002-10-08 18:36 ` Michael H. Warfield
2002-10-08 20:01 ` Maciej Soltysiak
2002-10-08 21:12 ` Kevin Dwyer
2002-10-08 21:53 ` Sundaram Ramasamy
2002-10-09 18:26 ` Michael H. Warfield
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=AF435BB1224A4C4888B58C546728EE323005@s2.valiant.com \
--to=keith@valiant.com \
--cc=netfilter@lists.netfilter.org \
--cc=sun@percipia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox