11 Nov
2002
11 Nov
'02
22:57
* M. Neubert wrote on Mon, Nov 11, 2002 at 13:29 +0100:
security report" says me now:
- httpd root UDP *:12396
Is that a new or modified worm?
Don't know, maybe you'd check securityfocus.com or a similar service.
Did it have success with me?
Well, I guess it's strange for httpd to have UDP sockets. Well, but I don't know why a worm should use multiple... Did you tried chkrootkit alreay? Tells netstat -anp --inet something useful? I would trace this a little, who knows... oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.