Re: Solved !! "Girlnextdoor_" TCP Ports 1025/1028

From: Harlan Carvey (keydet89at_private)
Date: Mon Mar 10 2003 - 10:50:46 PST

  • Next message: Bennett Todd: "Re: Real-world attacks on sendmail CA-2003-07 seen"

    you'll probably never get the answer to your
    question...the OP stated that he removed the entry,
    and he probably did so w/o recording the MAC times on
    the file...
    
    
    --- Nikunj Virani <nikunjat_private> wrote:
    > Its strange but i would surely like to know how the
    > name "Girlnextdoor_"
    > came into your hosts file. Was it some application
    > that did that ?
    > 
    > Regards,
    > Nikunj
    > ----- Original Message -----
    > From: "Salomao Barguil" <barguilat_private>
    > To: <incidentsat_private>
    > Sent: Friday, March 07, 2003 9:35 AM
    > Subject: Solved !! "Girlnextdoor_" TCP Ports
    > 1025/1028
    > 
    > 
    > > Hi Folks,
    > >
    > > Thanks for everybody help in this matter.
    > >
    > > It was the HOSTS file on the local Win2k desktop :
    > > -------------------------------------------
    > > # This is a sample HOSTS file used by Microsoft
    > TCP/IP
    > > for Windows.
    > > 127.0.0.1       localhost
    > > 0.0.0.0         Girlnextdoor_
    > > -------------------------------------------
    > >
    > > I removed the second line "Girlnextdoor_" and it
    > was
    > > replaced by the local host name in the netstat -a
    > > command.
    > >
    > > And Yes, I had already run all the basic tools,
    > like
    > > Foundstone Fport/Vision, SpyBot adware search &
    > > destroy....etc, nothing unusual shows up.
    > >
    > > Thanks again,
    > > nice teamwork !
    > >
    > > Sal.
    > >
    > >
    > >
    > > __________________________________________________
    > > Do you Yahoo!?
    > > Yahoo! Tax Center - forms, calculators, tips, more
    > > http://taxes.yahoo.com/
    > >
    > >
    >
    --------------------------------------------------------------------------
    > --
    > >
    > > <Pre>Lose another weekend managing your IDS?
    > > Take back your personal time.
    > > 15-day free trial of StillSecure Border
    > Guard.</Pre>
    > > <A
    > href="http://www.securityfocus.com/stillsecure">
    > http://www.securityfocus.com/stillsecure </A>
    > >
    > >
    > >
    > >
    > 
    > 
    > 
    >
    ----------------------------------------------------------------------------
    > 
    > <Pre>Lose another weekend managing your IDS?
    > Take back your personal time.
    > 15-day free trial of StillSecure Border Guard.</Pre>
    > <A href="http://www.securityfocus.com/stillsecure">
    > http://www.securityfocus.com/stillsecure </A>
    > 
    > 
    
    
    __________________________________________________
    Do you Yahoo!?
    Yahoo! Tax Center - forms, calculators, tips, more
    http://taxes.yahoo.com/
    
    ----------------------------------------------------------------------------
    
    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
    



    This archive was generated by hypermail 2b30 : Mon Mar 10 2003 - 12:07:41 PST