Messages in this thread | | | From | Alan Cox <> | Subject | Re: inetd Messages | Date | Thu, 21 Mar 1996 10:17:03 +0000 (GMT) |
| |
> Anybody finding these messages in their syslog, or the nmbd program in > their /etc/inetd.conf file should IMMEDIATELY shut down inetd, remove the > line concerning nmbd, and check their nmbd file size. I'm not sure if > there is a legitimate program out there named nmbd, but that is one of
Yes. Its the netbios name server.
> the back doors that was installed in my system a few weeks ago. It > allowed anyone telnetting to port 41 the ability to reboot or shutdown my > machine! The file size on my machine was approxiamately 4K (I'm not sure
Port 41 isnt nmb. That sounds like someone installed a port of the KA9Q remote reboot daemon on your box.
Alan
| |