From owner-freebsd-security Wed Nov 21 20:11:13 2001 Delivered-To: freebsd-security@freebsd.org Received: from smtp1.ihug.co.nz (smtp1.ihug.co.nz [203.109.252.7]) by hub.freebsd.org (Postfix) with ESMTP id 7C5F937B417 for ; Wed, 21 Nov 2001 20:11:06 -0800 (PST) Received: from geoff (p27-max1.wlg.ihug.co.nz [203.173.230.27]) by smtp1.ihug.co.nz (8.9.3/8.9.3/Debian 8.9.3-21) with SMTP id RAA24081 for ; Thu, 22 Nov 2001 17:10:57 +1300 X-Authentication-Warning: smtp1.ihug.co.nz: Host p27-max1.wlg.ihug.co.nz [203.173.230.27] claimed to be geoff Message-ID: <020801c1730b$8cd21fe0$41414fcb@lawn> From: "Geoff Lawn" To: Subject: Unknown transient service 1528/tcp Date: Thu, 22 Nov 2001 17:08:34 +1300 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hi there, I regularly do an nmap on our server with the following results... Port State Service 21/tcp open ftp 22/tcp open ssh 25/tcp open smtp 110/tcp open pop-3 443/tcp open https Recently I noticed the following service appear... 1528/tcp open mciautoreg I did another nmap a minute later and the service was no longer there. Does anyone know what this might be? Have I been hacked?? Thanks, Geoff To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message