Re: weird entry in netstat

[Pollywog <pollywog@shadypond.com>]

On 12-Sep-99 John Forest wrote:
> 
> I had something similar, also never seen before:
> Sep 11 18:07:37 slow named[116]: refused query on non-query socket from
> [205.188.153.108].4000
> Sep 11 18:08:07 slow last message repeated 5 times
> 
> A dig showed:
> 
> 108.153.188.205.in-addr.arpa.  1H IN PTR  fes-d012.icq.aol.com.
> 
> Could it be that aol has problems?

I found out that my weird entry was in fact Licq connecting to the ICQ
server.  AOL does have problems with ICQ:  There is a trojan going around
which looks like a jpeg and allows a cracker to obtain user's ICQ passwords.
If you get any jpegs from people you don't know, get rid of them.

--
Andrew