Re: !! Strange ports for attack

[Rune Kristian Viken <arcade () KVINESDAL COM>]

On Mon, 14 Aug 2000, you wrote:
> Does anyone know about TCP ports 17300,27374,1243,12346,12345 and
> exploits corresponding for these ports ?

Yes.

> Connection attempt to TCP 195.161.130.240:17300 from 195.133.72.11:4088

Don't know...

> Connection attempt to TCP 195.161.130.240:27374 from 195.133.72.11:4089

BackDoor-G2.svr.21, SubSeven

> Connection attempt to TCP 195.161.130.240:1243 from 195.133.72.11:4090

BackDoor-G, SubSeven

> Connection attempt to TCP 195.161.130.240:12346 from 195.133.72.11:4091

Netbus

> Connection attempt to TCP 195.161.130.240:12345 from 195.133.72.11:4092

Netbus


You were hit by a scan for machines infected by the above mentioned trojan
horses.  i don't think you should worry too much about it.

--
"Rune Kristian Viken" <arcade () kvinesdal com> / arcade@irc (EFnet/IRCnet)
Kvinesdalsnett System Administrator (http://arcade.kvinesdal.com/)