Carrie wrote:
> When I use Netstat -a to see what's happening on my box i keep
seeing this
> user on my smtp port.
> tcp 0 0 128.242.221.53:smtp 213.201.148.18:62702
> TIME_WAIT
>After you added him to your hosts.deny file, did you try turning off
>email so that he'd be disconnected, then turning it back on?
Yep, did that, didn't seem to work.
>You might also want to check your email parameters and make sure this
>IP isn't allowed to send out mail; could be that he's hooked up to you
>and using you for a spam machine. (Make sure that he's listed in the
>GUI for not being able to connect also.)
Did that too, also doesn't seem to help. Very strange !
How recently have you done a
>check to see if you've been haqd?
Yesterday as I was checking my raq for hacks I discovered this.
Have you got any tips or clues to trace how long this has been so ?
Regards,
Peter Broerse
ICDServers
>CarrieB
_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security
