Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-21 Thread Ralph Slooten
On Tue, 21 Jan 2003 14:18:59 -0500 Mark Weaver [EMAIL PROTECTED] wrote: Hi Ralph, Thats a cool site. Actually the first time I'd ever seen it. However, I couldn't find where you signed up to become a member. -- Mark http://spamcop.net/anonsignup.shtml This should be it. Please not

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-21 Thread Ralph Slooten
On Tue, 21 Jan 2003 13:53:00 -0500 Mark Weaver [EMAIL PROTECTED] wrote: Hey Ralph, From the way his log file read it sounds as though it's already too late and he should just do a reload. -- Mark I'm not sure Mark, The logs are logging connection attempts, thus not allowed, but if

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-21 Thread Ralph Slooten
On Tue, 21 Jan 2003 21:47:48 +0100 Ralph Slooten [EMAIL PROTECTED] wrote: This should be it. Please not you HAVE to use your real e-mail address ;-) Sorry, it should read: Please NOTE you HAVE to use your real e-mail address -- http://tuxpower.f2g.net/ http://axljab.homelinux.org:8080/ I

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-21 Thread Mark Weaver
Ralph Slooten wrote: On Sat, 18 Jan 2003 18:37:53 -0500 Mark Weaver [EMAIL PROTECTED] wrote: Ralph, have you done the leg work in tracking these connections and reported to the ISP they're coming from yet? That _should_ be the first place to begin. If your theory is correct then the sooner

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-21 Thread Mark Weaver
Ralph Slooten wrote: On Mon, 20 Jan 2003 01:10:19 +1100 Trevor Rhodes [EMAIL PROTECTED] wrote: The following is a third of my logfile. Is this not normal for you folks? Why do so many people get so worried when something shows up. Why? well just read what I added to almost all your

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-20 Thread Anne Wilson
On Monday 20 Jan 2003 2:11 am, Trevor Rhodes wrote: Then how would that equate to them telling me I had a score of 0 which is perfect? Is my security better than perfect or they don't want my business. hehe Trust? Who can I trust? I'm liable to pick the wrong person. Story of my life.

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-20 Thread Ralph Slooten
Not me. I know my mail is scanned automatically on the server for virusses, but I always get a warning, so no, it's not comming though this side. Are you sure it's the mailing-list that he's sending to? Greetings Ralph On Tue, 21 Jan 2003 01:50:00 +1300 John Rye [EMAIL PROTECTED] wrote:

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-20 Thread Stephen Kuhn
On Mon, 2003-01-20 at 23:50, John Rye wrote: While on the subject of trojans etc Is anyone else on this list getting repeat mailings from a user who appears to be using a node on 'cwpanama.net' ? This mail includes a variety of windows executables with .exe .scr and .pif extensions

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-20 Thread Stephen Kuhn
On Mon, 2003-01-20 at 21:06, Anne Wilson wrote: On Monday 20 Jan 2003 2:11 am, Trevor Rhodes wrote: Then how would that equate to them telling me I had a score of 0 which is perfect? Is my security better than perfect or they don't want my business. hehe Trust? Who can I trust? I'm

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-20 Thread John Rye
On Mon, 20 Jan 2003 16:50:56 +0100 Ralph Slooten [EMAIL PROTECTED] wrote: Not me. I know my mail is scanned automatically on the server for virusses, but I always get a warning, so no, it's not comming though this side. Are you sure it's the mailing-list that he's sending to? I didn't think

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-20 Thread Ralph Slooten
On Tue, 21 Jan 2003 09:59:58 +1300 John Rye [EMAIL PROTECTED] wrote: I didn't think I'd inferred they were coming thru the list. :-) they're not. This address is only used for maillist traffic, so it was a thought that maybe others on this list were getting them too. My ISP service doesn't

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread John Richard Smith
Ralph Slooten wrote: On Sat, 18 Jan 2003 18:37:53 -0500 Mark Weaver [EMAIL PROTECTED] wrote: Ralph, have you done the leg work in tracking these connections and reported to the ISP they're coming from yet? That _should_ be the first place to begin. If your theory is correct then the sooner

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Stephen Kuhn
On Sun, 2003-01-19 at 20:05, John Richard Smith wrote: OK, so this trojan ain't a uk one, how does one go about detecting it ? John Ralph's been using PortSentry on his box - the port under attack on his box was 635 - and the Portsentry report clearly showed that the infiltrator was an Aussue

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Ralph Slooten
On 19 Jan 2003 10:51:14 +1100 Stephen Kuhn [EMAIL PROTECTED] wrote: I've already contacted the ISP locally here - on both of their available addresses. Tomorrow (being Monday for us) I'm going to be in their neighbourhood and will call, and if necessary, stop in with a printed report. I

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread H.J.Bathoorn
On Sunday 19 January 2003 13:24, Ralph Slooten wrote: I don't know of course for sure if they are on this list, and scanning through all my archived mail for an IP-range isn't my amusement for sundays or any day for that matter ;-) I just took an intelligent guess. Greetings Ralph I just

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Ralph Slooten
On Sun, 19 Jan 2003 14:37:46 + H.J.Bathoorn [EMAIL PROTECTED] wrote: I just checked my SmoothWall stats, can't find any extraordinary activity there lately. Not like you're getting, anyway. That should get the lists off the hook=:o) Good hunting, Harm No connection attemps on port

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Trevor Rhodes
On Monday 20 Jan 2003 12:51 am, Ralph Slooten wrote: On Sun, 19 Jan 2003 14:37:46 + H.J.Bathoorn [EMAIL PROTECTED] wrote: I just checked my SmoothWall stats, can't find any extraordinary activity there lately. Not like you're getting, anyway. That should get the lists off the

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Ralph Slooten
On Mon, 20 Jan 2003 01:10:19 +1100 Trevor Rhodes [EMAIL PROTECTED] wrote: The following is a third of my logfile. Is this not normal for you folks? Why do so many people get so worried when something shows up. Why? well just read what I added to almost all your submitted port attacks. Sorry

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread g
Ralph Slooten wrote: sundays or any day for that matter ;-) I just took an intelligent guess. s.w.a.g. peace out. tc,hago. g . -- think green... save a tree, save a life, save time, save bandwidth, save storage. send email... text/plain - disable pgp/gpg/geek code =+= if you

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Anne Wilson
On Sunday 19 Jan 2003 1:24 pm, Ralph Slooten wrote: I don't know of course for sure if they are on this list, and scanning through all my archived mail for an IP-range isn't my amusement for sundays or any day for that matter ;-) I just took an intelligent guess. I just wonder if someone is

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Anne Wilson
On Sunday 19 Jan 2003 4:33 pm, Ralph Slooten wrote: On Sun, 19 Jan 2003 16:10:29 + Anne Wilson [EMAIL PROTECTED] wrote: No, not that one. A couple of selling ones, and one saying something like 'I found that site at last' - the sort of thing that always makes me suspicious. I just

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread H.J.Bathoorn
On Sunday 19 January 2003 13:51, Ralph Slooten wrote: On Sun, 19 Jan 2003 14:37:46 + H.J.Bathoorn [EMAIL PROTECTED] wrote: I just checked my SmoothWall stats, can't find any extraordinary activity there lately. Not like you're getting, anyway. That should get the lists off the

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Greg
Hi everyone I use this email address just for this list and have never had any spam I think the span you are getting came from some where else Hope this helps Greg Anne Wilson [EMAIL PROTECTED] wrote: On Sunday 19 Jan 2003 4:33 pm, Ralph Slooten wrote: On Sun, 19 Jan 2003 16:10:29 +

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Anne Wilson
On Sunday 19 Jan 2003 7:49 pm, Greg wrote: Hi everyone I use this email address just for this list and have never had any spam I think the span you are getting came from some where else Hope this helps Greg Anne Wilson [EMAIL PROTECTED] wrote: On Sunday 19 Jan 2003 4:33 pm, Ralph

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread H.J.Bathoorn
On Sunday 19 January 2003 19:49, Greg wrote: Hi everyone I use this email address just for this list and have never had any spam I think the span you are getting came from some where else Hope this helps Greg I tend to agree there. Spam and probes apparently come in waves. A month back

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Trevor Rhodes
The following is a third of my logfile. Is this not normal for you folks? Why do so many people get so worried when something shows up. Why? well just read what I added to almost all your submitted port attacks. Sorry to say this, but this is ignorance. You are being probed from all

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread H.J.Bathoorn
On Sunday 19 January 2003 21:18, Trevor Rhodes wrote: I know I'm about to open up a can of worms here, but can we not let it get out of control people. Ok, here goes. Is there a 'decent' online security site that could check my ports? Properly? Why not do it yourself using nmap(fe) or let

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-19 Thread Trevor Rhodes
HarM, Why not do it yourself using nmap(fe) or let somebody you trust do it? Caus'n I wouldn't know what the hell I was doin!!! :^) Could you explain nmap(fe) for me? Where? What? etc. Most of those sites would scare me s**tless if I'd have had a Winders-box. If you like FUD at it's

[newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Ralph Slooten
Hiya all again, My webserver is running portsentry, and has, on a daily basis been blocking and banning all connection attemps from an Australian IP, running on the connect.com.au network. -= Reason for the block =- Port-scanning on port 635 -= What is relevance is Port 635 =- Name: ADM worm

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Stephen Kuhn
On Sun, 2003-01-19 at 03:34, Ralph Slooten wrote: Hiya all again, My webserver is running portsentry, and has, on a daily basis been blocking and banning all connection attemps from an Australian IP, running on the connect.com.au network. Ha! It ain't me! (g) -= Reason for the block =-

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Ralph Slooten
On 19 Jan 2003 07:24:00 +1100 Stephen Kuhn [EMAIL PROTECTED] wrote: Mate, if YOU don't want to alert them, I'll be more than happy to both write them and call them (they're in my state - even though they're a sad ISP - but gives me someone to yell at)...ha! Thanks dude, Sent you the reports

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Stephen Kuhn
On Sun, 2003-01-19 at 07:55, Ralph Slooten wrote: On 19 Jan 2003 07:24:00 +1100 Stephen Kuhn [EMAIL PROTECTED] wrote: Mate, if YOU don't want to alert them, I'll be more than happy to both write them and call them (they're in my state - even though they're a sad ISP - but gives me

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Jason Guidry
On Sat, 2003-01-18 at 15:03, Stephen Kuhn wrote: For any POM's and Yanks that have a whinge, /dev/null I think I speak for all the americans on the list when I say...HUH??? -- Jason Guidry [EMAIL PROTECTED] Want to buy your Pack or Services from MandrakeSoft? Go to

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Stephen Kuhn
On Sun, 2003-01-19 at 09:51, Jason Guidry wrote: On Sat, 2003-01-18 at 15:03, Stephen Kuhn wrote: For any POM's and Yanks that have a whinge, /dev/null I think I speak for all the americans on the list when I say...HUH??? Being an American living in Australia, and soon to be an

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Ralph Slooten
On 18 Jan 2003 16:51:54 -0600 Jason Guidry [EMAIL PROTECTED] wrote: On Sat, 2003-01-18 at 15:03, Stephen Kuhn wrote: For any POM's and Yanks that have a whinge, /dev/null I think I speak for all the americans on the list when I say...HUH??? Hehe, I knew this would happen LOL.

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Ralph Slooten
On Sat, 18 Jan 2003 18:37:53 -0500 Mark Weaver [EMAIL PROTECTED] wrote: Ralph, have you done the leg work in tracking these connections and reported to the ISP they're coming from yet? That _should_ be the first place to begin. If your theory is correct then the sooner they know about it

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Mark Weaver
Ralph Slooten wrote: Hiya all again, My webserver is running portsentry, and has, on a daily basis been blocking and banning all connection attemps from an Australian IP, running on the connect.com.au network. -= Reason for the block =- Port-scanning on port 635 -= What is relevance is Port

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Stephen Kuhn
On Sun, 2003-01-19 at 10:37, Mark Weaver wrote: have you done the leg work in tracking these connections and reported to the ISP they're coming from yet? That _should_ be the first place to begin. If your theory is correct then the sooner they know about it the better for all concerned all

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Ralph Slooten
On Sat, 18 Jan 2003 18:43:54 -0500 Mark Weaver [EMAIL PROTECTED] wrote: Ralph, Thats something I've not yet done. Just exactly how does one do that to an incoming connection. I'd be real interested to learn. -- Mark Well, I use portsentry

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Dennis Myers
On Sat, 2003-01-18 at 17:01, Ralph Slooten wrote: On 18 Jan 2003 16:51:54 -0600 Jason Guidry [EMAIL PROTECTED] wrote: On Sat, 2003-01-18 at 15:03, Stephen Kuhn wrote: For any POM's and Yanks that have a whinge, /dev/null I think I speak for all the americans on the list when I

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Stephen Kuhn
On Sun, 2003-01-19 at 10:53, Dennis Myers wrote: Well! I never! Oh, actually I did once but not in public and that was only with a small audience. There were no repercussions and I did get a better room and living conditions for all the effort. We Americii's know how to whine. I was so

Re: [newbie] Trojan alert - Australian IP (connect.com.au)

2003-01-18 Thread Mark Weaver
Ralph Slooten wrote: On 18 Jan 2003 16:51:54 -0600 Jason Guidry [EMAIL PROTECTED] wrote: On Sat, 2003-01-18 at 15:03, Stephen Kuhn wrote: For any POM's and Yanks that have a whinge, /dev/null I think I speak for all the americans on the list when I say...HUH??? Hehe, I knew this would