jeg blev tidliger i dag medelt af min fierwall følgene :
min fierwall fangede den her og gav følgene besked :
inbound tcp on port 1025
aplicasion wininit \ system 32\mastask.exe
23-08-2003 kl 1409:32 + kl 1505
remote adresse 80.63.184.246
en oplsyt sjæl forklarede mig at konklusionen var med det matrial at
der var finde :
tak til Thomas :
References: <4oafkvg09gum6favvsstkcdtcm94prgpr7@4ax.com>
http://lists.insecure.org/lists/security-basics/2003/Aug/0484.html
(Sakset fra ovenstående URL)
The Windows RPC stuff tends to assign its services ports
just above 1024. 135 is where the "end-point mapper" that
will tell a client "the service you want is on my port 1025"
lives.
So the box is apparently running Windows RPC and allows
you (and probably anyone else on the Internet) to connect to
it. Sounds like a great candidate for W32.Blaster infection,
doesn't it? The scans you've seen may well have been attempts
to spread the infection to your machine.
--
Mv.
Bo M Mogensen
As you look through my door-Deep into my room-Can you feel the mighty wall of power
It's waiting, waiting in the gloom-The distant shadows of forgotten champions
Those who live in me still-And will rise when we challenge and kill Born again -You'll be born again!!
Black Sabbat "Born Again-1983 "
http://makeashorterlink.com/?D2BE52085