Re: [SLUG] Adore SSHD Trojan

2001-12-14 Thread Howard Lowndes
Woops, no. Tks for pointing that out. On Fri, 14 Dec 2001, Zhasper wrote: Were you root at the time? -- Howard. LANNet Computing Associates - Your Linux people Contact detail at http://www.lannetlinux.com We are either doing something, or we are not. 'Talking about' is a subset of 'not'.

[SLUG] Adore SSHD Trojan

2001-12-13 Thread Stephan Borg
Hello all, Over the last couple of days, a Debian 2.2r4 box I work on appears to have been infected by a Trojan. I have since upgraded SSH which I think was the leak. I have done an NMAP on the box. I have removed the known services from the output, shown below are the results. Port

Re: [SLUG] Adore SSHD Trojan

2001-12-13 Thread Damien Elmes
Stephan Borg [EMAIL PROTECTED] writes: Hello all, Over the last couple of days, a Debian 2.2r4 box I work on appears to have been infected by a Trojan. I have since upgraded SSH which I think was the leak. I have done an NMAP on the box. I have removed the known services from the

Re: [SLUG] Adore SSHD Trojan

2001-12-13 Thread Andre Pang
On Thu, Dec 13, 2001 at 11:08:57PM +1100, Stephan Borg wrote: Port State Service 139/tcpfilterednetbios-ssn - I don't have Samba 515/tcpfilteredprinter - no lpr as far as I'm aware 1080/tcp filteredsocks - no

Re: [SLUG] Adore SSHD Trojan

2001-12-13 Thread Howard Lowndes
An interesting aside on this one. I did a netstat -plt on my workstation (which is behind a strong firewall) and got the following. Notice how the controlling process doesn't show up, and I am wondering what is listening on port 32768 and 32769, even an lsof doesn't tell me: Proto Recv-Q

Re: [SLUG] Adore SSHD Trojan

2001-12-13 Thread Daniel Stone
On Fri, Dec 14, 2001 at 07:56:51AM +1100, Howard Lowndes wrote: An interesting aside on this one. I did a netstat -plt on my workstation (which is behind a strong firewall) and got the following. Notice how the controlling process doesn't show up, and I am wondering what is listening on