From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Keith R. Weiner" Subject: RE: some body hacked my system Date: Tue, 8 Oct 2002 11:17:34 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C26EDD.D43D4878" Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Sundaram Ramasamy , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C26EDD.D43D4878 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable That looks like warcraft 3 if I had to take a guess. It is a very good = game. Did you try unarchiving it? =20 You can block his ip address, but what is stopping this person from = hitting you from another ip? =20 Look at your ftp server. Maybe disable anonymous logins. Maybe put = quotas on. Maybe see if there are any patches to your ftp daemon. =20 What kind of ftp server are you using? WuFTPD, ms IIS, etc...? =20 I'm a newbie myself, but I'd just thought that I'd put in my 2 cents. -----Original Message----- From: Sundaram Ramasamy [mailto:sun@percipia.com] Sent: Tuesday, October 08, 2002 11:08 AM To: netfilter@lists.netfilter.org Subject: some body hacked my system Hi, I am allowing ftp connection in my firewall, some body used ftp port, = filled my hard disk space. He logged-in from 68.65.58.159 IP (/var/log/message) Oct 8 00:57:03 linux2 ftpd[25101]: FTP LOGIN FROM va-staff-u1-c5a-159.frbgva.adelphia.net [68.65.58.159] he created directory named WC3 and transfed follwoing files. bash-2.04# cd WC3 bash-2.04# ls wc3.part01.rar.gz wc3.part07.rar.gz wc3.part13.rar.gz = wc3.part19.rar.gz wc3.part02.rar.gz wc3.part08.rar.gz wc3.part14.rar.gz = wc3.part20.rar.gz wc3.part03.rar.gz wc3.part09.rar.gz wc3.part15.rar.gz = wc3.part21.rar.gz wc3.part04.rar.gz wc3.part10.rar.gz wc3.part16.rar.gz wc3.part05.rar.gz wc3.part11.rar.gz wc3.part17.rar.gz wc3.part06.rar.gz wc3.part12.rar.gz wc3.part18.rar.gz Is anybody knows what this file used for? How will i block this IP Address in my firewall? How will i check what else he did on my machine? Thanks SR ------_=_NextPart_001_01C26EDD.D43D4878 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

That=20 looks like warcraft 3 if I had to take a guess. It is a very good = game.=20 Did you try unarchiving it?

You=20 can block his ip address, but what is stopping this person from hitting = you from=20 another ip?

Look=20 at your ftp server. Maybe disable anonymous logins. Maybe put quotas on. Maybe see = if there=20 are any patches to your ftp daemon.

What=20 kind of ftp server are you using? WuFTPD, ms IIS,=20 etc...?

I'm a newbie myself, but I'd just = thought that=20 I'd put in my 2 cents.

-----Original Message-----
From: Sundaram Ramasamy=20 [mailto:sun@percipia.com]
Sent: Tuesday, October 08, 2002 = 11:08=20 AM
To: netfilter@lists.netfilter.org
Subject: some = body=20 hacked my system

Hi,

I=20 am allowing ftp connection in my firewall, some body used ftp port,=20 filled
my hard disk space. He logged-in from 68.65.58.159 IP=20 (/var/log/message)

Oct 8 00:57:03 linux2 ftpd[25101]: FTP = LOGIN=20 FROM
va-staff-u1-c5a-159.frbgva.adelphia.net = [68.65.58.159]

he=20 created directory named WC3 and transfed follwoing = files.

bash-2.04# cd=20 WC3
bash-2.04# ls
wc3.part01.rar.gz = wc3.part07.rar.gz =20 wc3.part13.rar.gz wc3.part19.rar.gz
wc3.part02.rar.gz =20 wc3.part08.rar.gz wc3.part14.rar.gz =20 wc3.part20.rar.gz
wc3.part03.rar.gz wc3.part09.rar.gz =20 wc3.part15.rar.gz wc3.part21.rar.gz
wc3.part04.rar.gz =20 wc3.part10.rar.gz wc3.part16.rar.gz
wc3.part05.rar.gz =20 wc3.part11.rar.gz wc3.part17.rar.gz
wc3.part06.rar.gz =20 wc3.part12.rar.gz wc3.part18.rar.gz

Is anybody knows what = this=20 file used for?

How will i block this IP Address in my=20 firewall?

How will i check what else he did on my=20 = machine?

Thanks
SR

<= /HTML> ------_=_NextPart_001_01C26EDD.D43D4878--