Re: Thousands of attempts to port 35825 and 11090

[email protected] 5 Dec 2006 17:05:08 -0000
Newsgroups gmane.comp.security.incidents
Message-ID <[email protected]>
I couldn't find anything on these ports either.  It's possible they're us=
ed by a trojan program.

First scan all your machines behind your router for these open ports.  It=
's possible one of your machines has been infected with a trojan, "phoned=
 home", and now the attacker is trying to gain access.
Just to be safe, run a full virus scan and adware/malware scan or your ma=
chines.

If these scans come up negative, and you don't have the ports open on any=
 of your machines, then you're probably safe.

How often do these connection attempts occur?

It's most likely an automated process, possibly scanning your entire IP b=
lock for infected machines.

-------------------------------------------------------------------------=
-----
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Ve=
gas.=20
World renowned security experts reveal tomorrow's threats today. Free of=20
vendor pitches, the Briefings are designed to be pragmatic regardless of =
your=20
security environment. Featuring 36 hands-on training courses and 10 confe=
rence=20
tracks, networking opportunities with over 2,500 delegates from 40+ natio=
ns.=20

http://www.blackhat.com
-------------------------------------------------------------------------=
-----