Hello Andrew
On 17-Dec-00, you wrote:
> I had been in a few chats and was about to disconnect. I opened genesis'
> GUI and found that I had an attempted access from someone to my machine.
>
> Ok, MAYBE I am being a bit paranoid, but I think that sometimes you must
> say things so others can learn from it too, before they get REALLY hurt.
As some already replied, it could of been an IRC server requesting auth
(identd), or as alot of IRC servers do now, is check for open socks proxies
or wingates that are abused to flood irc networks.
But then again, you say it was from a BT user.. Maybe it was someone mass
scanning your ISP..
This does happen alot, they normally scan for Windows trojans, or vulnerable
daemons that can be used to gain access to machines.
When it happens send the timestamped log to abuse@their ISP.
They would normally warn or diwsconnect the user doing this.
Anyway, nothing to really worry about if you;re on an Amiga, and you get the
occaisonal scan. But to make sure your Amiga doesnt have a trojan:
Type netstat -a in shell.
And make sure you have no open ports.. (unless you FTP'ing or DCC'ing etc..)
Best to check offline, but when genesis is open.
Open port would look like this:
14.Workbench:> netstat -a
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
*tcp 0 0 *.6969 *.* LISTEN*
tcp 0 0 1cust143.1026 omon.oz.org.4400 ESTABLISHED
^^ the Line i put in bold shos port 6969 is open. This is probably a BAD
thing.
So make sure the port is blocked, and try to figure out what trojan has
opened it. A virus checker will help. If it doesnt find it.. replace
standard system stuff like c:, libs: devs: and l: etc..
Bye
___________________________________________________________________
AmIRC Mailing List - http://www.vapor.com/amirc/
AmIRC FAQ......: http://faq.vapor.com/amirc/
Listserver Help: mailto:[EMAIL PROTECTED]?Subject=HELP
Unsubscribe....: mailto:[EMAIL PROTECTED]?Subject=UNSUBSCRIBE
