Ethereal-users: RE: [Ethereal-users] Solved: 78 percent of ARP packets on the network

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Simon Hailstone" <Simon.Hailstone@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 28 May 2004 11:06:07 +0100
> This definitely is not normal and we found some
> weird program listening(??) on port 9876 on every
> machine. Maybe a bug in this worm/trojan/whatever
> caused it to arp without learning the response.

There are two trojans that are known to operate on
tcp/9876, Rux and CyberAttacker/"Portal of Doom".
Neither of them are very nice :-(

Hope you got everything cleaned up OK!


Best Regards,

Simon Hailstone
Orthogon Systems