Rod James Bio wrote:
Hi, I've been wondering about my friends case. Seems that when he nmapped his machine port 21 is open, but there is no ftp daemon installed. He tried"lsof -i :21" but it did not return anything. He also tried "netstat -an | grep 21" also nothing.So he asked other people and they told him that his machine was hacked. The lsof and netstat was modified. The port 21 was a backdoor placed by the hacker. Now I am not really contented with this answers. Any suggestions?
Try 'telnet your.friends.ip 21' if that works, something is definitely wrong with your friends pc.If so, check the process list and see if you find anything you don't recognize. Kill that process, and try to telnet again. Do all of this with only a local network connection, so nobody from the internet can reach the possibly hijacked pc. However, when hacked reinstalling might be the fastest way to get rid of any malicious software.
Sjoerd
Attachment:
signature.asc
Description: OpenPGP digital signature