Security Incidents mailing list archives

Virus or Hacked NEW PC?


From: Jeff Pults <j_pults () YAHOO COM>
Date: Wed, 22 Nov 2000 20:52:14 -0800

I just purchased a new HP PC and it starts up listening on port 5000 tcp and udp port 1900 even after completely 
reloading from the recovery CD's. HP tech support said to contact my internet provider since I have a dsl connection. 
They could not give me any explanation as to why these ports were open even when installed and not connected to the 
internet. Once I did discover this I installed an IDS and immediately started getting udp port probes from a specific 
address. Any idea's or suggestions would be appreciated. Once connected to the internet here is a netstat -an:

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:5000           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:5017           0.0.0.0:0              LISTENING
  TCP    192.168.1.100:139      0.0.0.0:0              LISTENING
  UDP    0.0.0.0:1364           *:*
  UDP    127.0.0.1:1376         *:*
  UDP    192.168.1.100:1900     *:*
  UDP    192.168.1.100:137      *:*
  UDP    192.168.1.100:138      *:*





---------------------------------
Do You Yahoo!?
Yahoo! Shopping - Thousands of Stores. Millions of Products.


Current thread: