To help answer your question, I found a good list of ports and what
backdoors and other nasty stuff that can use them. I would have to agree
that there is a back door. The one that I can see for sure is Bla Trojan at
port 1042. I hope that the list will help you.

http://www.glocksoft.com/trojan_port.htm

Good luck. It looks like you are going to have some long days. :-)

James Arnott
System Administrator

> Two other exchange servers show these ports open.
> Port 1042 - Bla
> Port 1059 - Nimreg
>
> Two questions. Does anybody know what these
> are? And am I right in assuming that these machines
> have been compromised and will need to be rebuilt?

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]