TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Someone is checking to see if there is a compromised Linux system at your
location with a TOrn rootkit installed. If such a system exists there is
likely a trojanized ssh daemon listening at port 47017 on that system. You
can find further information at the following URLs:
http://www.datafellows.com/v-descs/torn.shtml
http://www.sans.org/y2k/t0rn.htm
http://packetstorm.securify.com/papers/IDS/t0rn.txt
http://www.linux.ie/pipermail/ilug/2000-October/024407.html
At 08:09 AM 6/6/2001 +0200, [EMAIL PROTECTED] wrote:
>TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
>[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
>----------------------------------------------------------------------------
>
>Hello!
>Do anybody know what port 47017 is used for? Our network have been scann for
>this port.
>
>Sevald O. Lund
>Systemkonsulent
>____________________________________________________________________________
>______
>Direkte: 73 53 94 58 Mobil: 93 01 15 64
>Sentralbord: 73 53 95 00 Telefaks: 73 53 95 01
>E-post: [EMAIL PROTECTED]
>
>Eterra as,
>Stiklestadveien 3
>7489 TRONDHEIM
>Organisasjonsnr. 976239997
>http://www.eterra.no
>
>Et Merkantildata selskap
>
>
>
>
