From owner-freebsd-questions  Thu Apr  4  8:26:51 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from tomts7-srv.bellnexxia.net (tomts7.bellnexxia.net [209.226.175.40])
	by hub.freebsd.org (Postfix) with ESMTP id 579AB37B417
	for <freebsd-questions@freebsd.org>; Thu,  4 Apr 2002 08:26:35 -0800 (PST)
Received: from scaryg.shacknet.nu ([64.231.142.160])
          by tomts7-srv.bellnexxia.net
          (InterMail vM.4.01.03.23 201-229-121-123-20010418) with ESMTP
          id <20020404162634.RXFZ17738.tomts7-srv.bellnexxia.net@scaryg.shacknet.nu>;
          Thu, 4 Apr 2002 11:26:34 -0500
Received: from localhost ([::1] helo=scaryg.shacknet.nu)
	by scaryg.shacknet.nu with smtp (Exim 3.35 #1)
	id 16tA5U-0003A6-00; Thu, 04 Apr 2002 11:27:49 -0500
Date: Thu, 4 Apr 2002 11:27:47 -0500
From: ScaryG <freymann@scaryg.shacknet.nu>
To: Mike Dewhirst <Dewhirst.M@UCLES.org.uk>
Cc: freebsd-questions@freebsd.org
Subject: Re: have I been hacked?!
Message-Id: <20020404112747.6ca965ff.freymann@scaryg.shacknet.nu>
In-Reply-To: <0B0368CED76DD4118E1200D0B73E9B5D041E9FA5@MAIL1>
References: <0B0368CED76DD4118E1200D0B73E9B5D041E9FA5@MAIL1>
X-Mailer: Sylpheed version 0.7.4 (GTK+ 1.2.10; i386-portbld-freebsd4.4)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-MailScanner: Found to be clean
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

On Thu, 4 Apr 2002 17:13:15 +0100 
Mike Dewhirst <Dewhirst.M@UCLES.org.uk> wrote:

> I did a netscan of my box (which I;ve not done for 2-3 months or so) and
> spotted this:
> 
> 1505/tcp   open        funkproxy
> 4008/tcp   open        netcheque

 Check out google.com for these.

 FunkProxy, as far as I know, is a windoze-based proxy server.

 NetCheque is most likely used with online transactions.

 Mind you, it could be showing up because your are connecting to these
ports on remote hosts? (I dunno) If not then you are running something on
your local machine that is acting as a proxy and doing netcheque. 

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message