Re: Backdoor ?? "Girlnextdoor_" TCP Ports 1025/1028

From: Kevin Patz (jambo_catat_private)
Date: Wed Mar 05 2003 - 10:56:40 PST

  • Next message: kyleat_private: "RE: TCP 445 Scan?"

    
     ('binary' encoding is not supported, stored as-is)
    In-Reply-To: <1046857854.1736.10.camel@JayHome>
    
    Do a "netstat -a -n" to get IP addresses instead of 
    host names.  Girlnextdoor is the name of a computer on 
    your network (NETBIOS name), or a reverse DNS 
    resolution on the IP address.  If a netstat with the -
    n option shows 0.0.0.0:0 then it's just services on 
    your PC listening for connections (epmap, microsoft-
    ds, etc.).
    
    What's in your hosts and lmhosts files?
    
    >> C:\>netstat -a
    >>=20
    >> Active Connections
    >>=20
    >>   Proto  Local Address          Foreign 
    Address      =20
    >> State
    >>   TCP    p4win2k:epmap          
    Girlnextdoor_:0      =20
    >> LISTENING
    >>   TCP    p4win2k:microsoft-ds   
    Girlnextdoor_:0      =20
    >> LISTENING
    >>   TCP    p4win2k:1025           
    Girlnextdoor_:0      =20
    >> LISTENING
    >>   TCP    p4win2k:1028           
    Girlnextdoor_:0      =20
    >> LISTENING
    >>   TCP    p4win2k:netbios-ssn    
    Girlnextdoor_:0      =20
    >> LISTENING
    >>   UDP    p4win2k:epmap          *:*
    >>   UDP    p4win2k:microsoft-ds   *:*
    >>   UDP    p4win2k:1027           *:*
    >>   UDP    p4win2k:1030           *:*
    >>   UDP    p4win2k:netbios-ns     *:*
    >>   UDP    p4win2k:netbios-dgm    *:*
    >>   UDP    p4win2k:isakmp         *:*
    >>=20
    >> C:\>
    
    ----------------------------------------------------------------------------
    
    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
    



    This archive was generated by hypermail 2b30 : Wed Mar 05 2003 - 14:31:28 PST