On August 27, 2002 08:22 am, Janusat_private wrote: > I recogniced some weird connections from my box (w98) > to other computers. As soon as i connect to the > internet a connection from local port 1026 to port 6667 > on 65.185.135.125 was established. I connected to that > server and it is an irc server (MusIRC Internet Relay > Chat Network). I found a bot using my adress with a > random name made up of letters. 0wn4g3 details ommitted... > I couldnt find a freeware tool to find out which > process is using this specific irc connection, nor did > a scan with f-prot or housecall or panda reveal any > viral or trojan activity. > > Any help or info would be really appreciated. Thanks in > advance > lsof will be your friend on unixes:-) (LS Open Files) For MS products as I assume you are using from the MIRC usage, check out the excellent tools the folks at www.sysinternals.com put out. (My thanks to them if they are reading for they are truly useful to me...) There was another lsof like tool for windows called "inzider" you might want to look at too... cheers, --dr -- drat_private pgp: http://dragos.com/kyxpgp Advance CanSecWest/03 registration available: http://cansecwest.com "The question of whether computers can think is like the question of whether submarines can swim." --Edsger Wybe Dijkstra 1930-2002 ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Aug 27 2002 - 13:37:46 PDT