Port 998 TCP Busboy and Port 985

[Theresa Semmens <Theresa.Semmens () NDSU NODAK EDU>]

We have a machine that has been compromised twice in the last four days.
Both times an FTP server has been loaded on the machine.  The ports listed
are 985 and port 998 which is assigned to Busboy.  Can anyone tell me
anything about these ports?  My search reveals they are not ports commonly
used by Trojans or worms. 

Theresa Semmens, CISA
NDSU IT Security Officer
North Dakota State University
Fargo, ND 58101
701.231.5870
Theresa.Semmens () ndsu nodak edu

Happiness comes through doors you didn't know you left open.

This electronic mail message may contain privileged and confidential
information.  If the reader is not the intended recipient, or the employee
or agent responsible to deliver it to the intended recipient, you are hereby
notified that any use, disclosure, dissemination, distribution, or copying
of this communication and any attached files may be strictly prohibited.  If
you have received this communication in error, please immediately notify
Information Technology Services contact by telephone at 701-231-5870, or by
reply e-mail, and permanently delete the message from your system.  Receipt
by anyone other than the intended recipient is not a waiver of any privilege
or immunity. 
 

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.