From owner-freebsd-questions  Thu Apr  4  8:28:20 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from aurlov.ptt.ru (aurlov.ptt.ru [195.34.55.115])
	by hub.freebsd.org (Postfix) with SMTP id 24B5C37B41D
	for <questions@freebsd.org>; Thu,  4 Apr 2002 08:28:12 -0800 (PST)
Received: from ptt.ru (localhost [127.0.0.1])
	by aurlov.ptt.ru (Postfix) with ESMTP
	id 1D5C35854; Thu,  4 Apr 2002 19:25:33 +0000 (GMT)
Message-ID: <3CACA8AC.8030403@ptt.ru>
Date: Thu, 04 Apr 2002 19:25:32 +0000
From: "Aleksey I. Yurlov" <webmaster@ptt.ru>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.9+) Gecko/20020312
X-Accept-Language: en-us, ru
MIME-Version: 1.0
To: Mike Dewhirst <Dewhirst.M@UCLES.org.uk>, questions@freebsd.org
Subject: Re: have I been hacked?!
References: <0B0368CED76DD4118E1200D0B73E9B5D041E9FA5@MAIL1>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

>     

Mike, u sure that U didn't gave some admin roles to someone else on this 
box?
Maybe it was 1 year ago, and you forgot about it?
If no - it's seems, that someone have privileges to open new services 
 on this box...

> I did a netscan of my box (which I;ve not done for 2-3 months or so) 
> and spotted this:
>
> 1505/tcp   open        funkproxy
> 4008/tcp   open        netcheque
>
> I've never heard of either.
>
> Has the system been compromised?
>
> Any help would be extremely appreciated.
>
> Mike
>
>
> This message was written in plain text mode.
> Everything below the dotted line was not
> written by the author of this email.
> ----------------------
>
> |
>
> =**********************************************************
>
> If you are not the intended recipient, employee or agent responsible 
> for delivering the message to the intended recipient, you are hereby 
> notified that any dissemination or copying of this communication and 
> its attachments is strictly prohibited.
>
> If you have received this communication and its attachments in error, 
> please return the original message and attachments to the sender using 
> the reply facility on e-mail.
>
> Internet communications are not secure and therefore the UCLES Group 
> does not accept legal responsibility for the contents of this message. 
> Any views or opinions presented are solely those of the author and do 
> not necessarily represent those of the UCLES Group unless otherwise 
> specifically stated.
>
> This footnote also confirms that this email message has been swept by
> MIMEsweeper for the presence of computer viruses although this does 
> not guarantee that this email is virus free.
>
> **********************************************************=
> | 





To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message