> When I use Netstat -a to see what's happening on my box i keep
seeing this
> user on my smtp port.
> tcp 0 0 128.242.221.53:smtp 213.201.148.18:62702
> TIME_WAIT
After you added him to your hosts.deny file, did you try turning off
email so that he'd be disconnected, then turning it back on?
You might also want to check your email parameters and make sure this
IP isn't allowed to send out mail; could be that he's hooked up to you
and using you for a spam machine. (Make sure that he's listed in the
GUI for not being able to connect also.) How recently have you done a
check to see if you've been haqd?
CarrieB
_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security
