>Well I went a away for a week and to my suprise when I got back my hd >was full. I accidentaly left my ftp server on with anonymous acces. >Well somebody in france started a ftp server from my comp. >after removing the french movies and the folders I turned of >anonymous and nobody can get into my comp. > >I traced the ip of the person who started the server and it came from >somebody in france. I checked to see what ports they had open, and >ftp, http, and 1033???? I checked on the internet and port 1033 is >used by a program (Trojan) called Netspy. I thought I was ok because >my port 1033 was not open. but my computer is constantly recieving >packets. I didn't think that this was normal so I decided to try some >other things > >After using netstat It shows that I have a loop back from port 1033 >on my comp to 803 and vice versa. I put up a really secure firewall >for the time being but I can't find out how to remove this trojan, if >it is one. > >Anybody have any idea
My understanding is that port 1033 in Mac OS X has something to do with NetInfo. This port being open has been widely reported by many; IIRC, it's open on -all- machines running Mac OS X. I doubt it has anything to do with the old Netspy trojan; in fact, Netspy was a Microsoft Windows afflicting trojan, so the likelihood of it affecting any UNIX OS, including Mac OS X, is somewhere between nil and zero. If you left anonymous FTP access on, then that is probably the best explanation of your ills; by default, the Mac OS X ftp software has anonymous login disabled. Anonymous FTP is a -VERY- bad idea unless you're running a server that is completely dedicated to FTP access. -- Jeremy Derr <[EMAIL PROTECTED]> Low End Macs - G-Books "ListNanny" Any statements herein represent my opinion and do not represent those of my employer. In fact, they don't even know that I know how to use a computer. They don't think very highly of me, it seems. At any rate, I'm probably just spouting off about things I couldn't likely comprehend, so please just ignore me. -- The iMac List is sponsored by <http://lowendmac.com/> and... Small Dog Electronics http://www.smalldog.com | Refurbished Drives | - Epson Stylus Color 580 Printers - new at $69 | & CDRWs on Sale! | PowerON Computer Services <http://www.poweron.com> REPLACEMENT PARTS in STOCK Drives, CD-ROMs, RAM, Mac OS SW, Power Supply <mailto:[EMAIL PROTECTED]> Support Low End Mac <http://lowendmac.com/lists/support.html> iMac List info: <http://lowendmac.com/imac/list.shtml> Send list messages to: <mailto:[EMAIL PROTECTED]> To unsubscribe, email: <mailto:[EMAIL PROTECTED]> For digest mode, email: <mailto:[EMAIL PROTECTED]> Subscription questions: <mailto:[EMAIL PROTECTED]> Archive: <http://www.mail-archive.com/imac-list%40mail.maclaunch.com/> Using a Mac? Free email & more at Applelinks! http://www.applelinks.com
