Re: irc port open on 6668/tcp and 6667/tcp

[Mike Dresser <mdresser () windsormachine com>]

On Tue, 11 Feb 2003, [iso-8859-1] Harish Gondavale wrote:

> Hi all,
>
> We are having two NT 4 domain controller servers, PDC
> & BDC. Both are used as resource domain controllers,
> print and file servers. Same applications like quota
> manager, hp jet direct software, are installed on both
> the servers.
>
> Recently I was trying nampwin 1.3.1 and found that out
> of these servers, PDC has open tcp port on 6667 & 6668
> for irc. I tried to search some information on
> internet and found that there are some trojans also,
> which open these ports.

Well, connect to the port, and see what it says.

It could also be your battery backup software if you use APC PowerChute,
which uses ports 6667 and 6668 as well

If you connect to it and it just sits there stupidly, it's likely
powerchute, whereas an IRC server will spit a bunch of text at you.

And then there's whatever a trojan would do.

But my first check would be for powerchute software.

Mike