Quote:
|
Originally Posted by BBKing
HTTPS is 443, not 445.
Also, how many people run HTTPS on their PCs?
|
The Ip addy of one of those listed belongs to
-------------------------------------------------
inetnum: 81.97.0.0 - 81.97.191.255
netname: NTL
descr: NTL Standalone CM - Baguley
country: GB
admin-c: NNMC1-RIPE
tech-c: NNMC1-RIPE
status: ASSIGNED PA
mnt-by: AS5089-MNT
changed:
hostmaster@ntli.net 20020731
source: RIPE
route: 81.96.0.0/12
descr: NTL-UK-IP-BLOCK
origin: AS5089
mnt-by: AS5089-MNT
changed:
hostmaster@ntli.net 20020614
source: RIPE
role: NTLI Network Management Centre
address: NTL Internet
address: Crawley Court
address: Winchester
address: Hampshire
address: SO21 2QA
trouble: ----------------------------------------------
Can someone confirm this is one of NTLs OWN Servers>?
It appears to be running with the following ports open
25
110
113
139
445
1025 ****
***Basically the Win2K server on the NTL network could be infected with any number of trojans using this port, "always open" to spread itself via the SMB over TCP.
There is only one reason the server would need to use 445 was if it was trying to conect to other PC systems.
Win2K does use 1025 for the Distributed Transaction Coordinator service which is enabled by default on a Windows
2000 server But it opens TCP port 3372, and a single TCP port higher than 1023 (ie likely to be 1025 ).
I scanned all ports up to 6000 (Using another ISP) and 3372 isnt open so it may not be that particular service.
So based on the scan I did my conclusion is it is likely to be infected.