[Dshield] Obscure question

Pete Cap peteoutside at yahoo.com
Mon Mar 15 19:26:33 GMT 2004


Hey Paul, List,

Just to clarify--he's got open ports with no apparent service listening?
How incredibly weird.  I haven't got any info for you, but my curiosity is piqued--please be sure and let us know how it turns out.
 
Regards,
Pete

Paul Marsh <pmarsh at nmefdn.org> wrote:
I know this is a totally off the wall question but here goes. I've got
clean Win2k install all SP's loaded, NAV 100% up to date. Gave it to a
user who plugged it in to his cable modem and then started the install
of ZoneAlarm. Now I told him to install and config ZoneAlarm prior to
plugging into the modem but, well enough said.... Anyway I gave him a
quick scan and found the following ports open 21 FTP, 389 Ldap, 1002
Unassigned and 1720 Netmeeting. I asked him to see what was listening
via netstat but nothing is listening on these ports? I asked him to
un-install and re-install ZoneAlarm making sure that he does not let
anything have access to the internet. Well the system is backup with
the same ports open? He's done a GRC, Broadband and Sygate scan himself
and found nothing open? Tonight I'm going to Nmap the machine to see
what's cook'in but in the mean time does anyone have any ideas as to
what might be going on?

Thanx, Paul

_______________________________________________
list mailing list
list at dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
Do you Yahoo!?
Yahoo! Mail - More reliable, more storage, less spam


More information about the list mailing list