[Dshield] RE: Proof of hacker?

Ed Truitt ed.truitt at etee2k.net
Tue Aug 27 22:35:20 GMT 2002


John, I think you meant "netstat -a" rather than "netstat -s".


----- Original Message -----
From: "Thompson, John J" <ThompsonJJ at mail.medicine.uiowa.edu>
To: <list at dshield.org>
Cc: "'Linda'" <godawgs47 at ellijay.com>
Sent: Tuesday, August 27, 2002 11:42 AM
Subject: [Dshield] RE: Proof of hacker?


> <<I do remember getting something fwd from a known friend and noticed
there
> email address had changed to HEYYOU something. I clicked on it and opened
> it. When I wrote my friend back they couldn't remember sending me
anything.
> (Linda)>>
>
> That was most likely the problem. I bet you installed a Trojan on your own
> system via that attachment. No attachments on the net are worth the 10
> seconds of laughs with the weeks of agony if you Trojan yourself. Disable
> zone alarm, Run netstat -s >> ns.txt   and paste the contents of ns.txt to
> an email and let us see the results. I bet you have a Trojan port opened
> unless you or the intruder has already shut it down.
>
>
>
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
>




More information about the list mailing list