Ben,
Okay, I am a little confused, so I pretend I am 4 :-)
This is what I just got using Netstat:
C:\>netstat
Active Connections
Proto Local Address Foreign Address State
TCP socket7:2886 wsimg.auctionwatch.com:80 CLOSE_WAIT
TCP socket7:2889 www.auctionwatch.com:80 CLOSE_WAIT
TCP socket7:3752 216.35.217.182:17027 SYN_SENT
C:\>
So I should disconnect from the internet, and reconnect, and try
telnetting to 216.35.217.182:17027, or was the 127.0.0.1 more than just
an example? I don't know much about this type of thing. I am more
comfortable hooking up hardware.
When I do try telnetting, should I do it on my 486 with Nettamer or
Arachne?
Chad
Ben A L Jemmett wrote:
>
> > TCP socket7:2378 216.35.217.182:17027 ESTABLISHED
>
> > I got the above after I closed Netscape, and didn't have any other
> > Internet software going except the dial-up connection. I know that
> > isn't my ISP's IP address. The fact that this is using such a high port
> > address seems suspicious as well... to me anyways. What do you think?
> The port 17027 rings a bell somewhere - I think a number of worms and remote
> control programs use numbers in the 10000 range. Try doing a netstat, and
> finding the port number on your machine (2378 here) - then disconnect and do
> 'telnet 127.0.0.1 portnumber' and see if anything shows up.
>
> Regards,
> Ben A L Jemmett.
> (http://web.ukonline.co.uk/ben.jemmett/, http://www.deltasoft.com/)
>
> To unsubscribe from SURVPC send a message to [EMAIL PROTECTED] with
> unsubscribe SURVPC in the body of the message.
> Also, trim this footer from any quoted replies.
> More info can be found at;
> http://www.softcon.com/archives/SURVPC.html
To unsubscribe from SURVPC send a message to [EMAIL PROTECTED] with
unsubscribe SURVPC in the body of the message.
Also, trim this footer from any quoted replies.
More info can be found at;
http://www.softcon.com/archives/SURVPC.html
