Ver Mensaje Individual
  #1 (permalink)  
Antiguo 20/08/2006, 15:08
machibest
 
Fecha de Ingreso: agosto-2006
Mensajes: 2
Antigüedad: 17 años, 8 meses
Puntos: 0
conexiones SMTP sospechosas

Hola gente, note que el LED de mi router parpadeaba continuamente indicando gran acitividad de mi maquina. Inspeccione unos segundos con el Ethereal a ver de que paquetes se trataba, y descubri gran cantidad de conexiones SMTP con servidores desconocidos de MX. Es evidente que tengo algun virus o troyano ejecutando un servidor SMTP en mi maquina o algo similiar. La salida de mi netstat tambien evidencia esto:

Conexiones activas

Proto Dirección local Dirección remota Estado
TCP server:3069 localhost:3070 ESTABLISHED
TCP server:3070 localhost:3069 ESTABLISHED
TCP server:1036 2.179.232.72.reverse.layeredtech.com:http ESTAB
LISHED
TCP server:1325 by2m6-cs21.msgr.hotmail.com:1863 ESTABLISHED
TCP server:2460 montecarlo.inta.gov.ar:smtp TIME_WAIT
TCP server:2507 213.193.212.26:smtp FIN_WAIT_2
TCP server:2546 bay0-mc7-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2558 relay.lojasrenner.com.br:smtp TIME_WAIT
TCP server:2559 gateway-r.comcast.net:smtp TIME_WAIT
TCP server:2568 lhs.lowell.k12.ma.us:smtp TIME_WAIT
TCP server:2569 rly2.ypf.com.ar:smtp TIME_WAIT
TCP server:2571 mail.charter.net:smtp CLOSING
TCP server:2579 mail.hotmail.com:smtp TIME_WAIT
TCP server:2584 bay0-mc9-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2588 peoplesservices.com:smtp FIN_WAIT_2
TCP server:2590 *.s7b2.psmtp.com:smtp TIME_WAIT
TCP server:2592 bay0-mc7-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2597 smtp-f3.seeweb.it:smtp TIME_WAIT
TCP server:2601 bay0-mc9-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2608 216.129.105.39:smtp TIME_WAIT
TCP server:2612 mail2.rollernet.us:smtp TIME_WAIT
TCP server:2615 mail2.mailwatch.com:smtp TIME_WAIT
TCP server:2616 kvbc1.gtweed.com:smtp TIME_WAIT
TCP server:2617 216.129.105.39:smtp TIME_WAIT
TCP server:2621 ya.mx.aol.com:smtp TIME_WAIT
TCP server:2630 yj.mx.aol.com:smtp TIME_WAIT
TCP server:2634 nalu.org:smtp TIME_WAIT
TCP server:2641 clmboh-mx-06.mgw.rr.com:smtp CLOSING
TCP server:2648 orngca-mx-01.mgw.rr.com:smtp CLOSING
TCP server:2651 ls007.lutron.com:smtp FIN_WAIT_2
TCP server:2652 maunaloa.pausd.org:smtp TIME_WAIT
TCP server:2653 maunaloa.pausd.org:smtp TIME_WAIT
TCP server:2656 orngca-mx-01.mgw.rr.com:smtp CLOSING
TCP server:2659 clmboh-mx-11.mgw.rr.com:smtp CLOSING
TCP server:2661 mx.uol.com.br:smtp TIME_WAIT
TCP server:2663 na.mx.aol.com:smtp TIME_WAIT
TCP server:2672 bay0-mc9-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2673 xk.mx.aol.com:smtp TIME_WAIT
TCP server:2677 rmail-223.hanmail.net:smtp TIME_WAIT
TCP server:2678 a34-mta03.direcpc.com:smtp TIME_WAIT
TCP server:2682 125.60.3.219:smtp TIME_WAIT
TCP server:2685 mx1.bezeqint.net:smtp FIN_WAIT_1
TCP server:2687 mail145.messagelabs.com:smtp TIME_WAIT
TCP server:2689 hknpx4.hknet.com:smtp FIN_WAIT_1
TCP server:2691 yj.mx.aol.com:smtp TIME_WAIT
TCP server:2694 *.s7a1.psmtp.com:smtp FIN_WAIT_2
TCP server:2697 na.mx.aol.com:smtp TIME_WAIT
TCP server:2704 smh-mail.smh.com:smtp FIN_WAIT_2
TCP server:2705 yj.mx.aol.com:smtp TIME_WAIT
TCP server:2706 elvas.procergs.com.br:smtp TIME_WAIT
TCP server:2708 mail.hotmail.com:smtp TIME_WAIT
TCP server:2724 isasrv.etae.com:smtp TIME_WAIT
TCP server:2730 62.189.91.3:smtp TIME_WAIT
TCP server:2737 mail.hotmail.com:smtp TIME_WAIT
TCP server:2743 yi.mx.aol.com:smtp TIME_WAIT
TCP server:2747 r38.acshost.net:smtp TIME_WAIT
TCP server:2752 sohumx.sohu.com:smtp TIME_WAIT
TCP server:2754 imsmx11.netvigator.com:smtp TIME_WAIT
TCP server:2759 bay0-mc9-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2760 *.s7b2.psmtp.com:smtp FIN_WAIT_2
TCP server:2764 mail.cal.co.il:smtp ESTABLISHED
TCP server:2766 by2msg2132814.phx.gbl:1863 ESTABLISHED
TCP server:2767 oldsac.osb.net:smtp ESTABLISHED
TCP server:2769 201-212-108-19.prima.net.ar:1193 ESTABLISHED
TCP server:2770 hknpx4.hknet.com:smtp ESTABLISHED
TCP server:2771 mail.ghi.org.il:smtp TIME_WAIT
TCP server:2775 216.255.185.138:http CLOSE_WAIT
TCP server:2777 by2msg1282514.phx.gbl:1863 ESTABLISHED
TCP server:2778 by2msg1172206.phx.gbl:1863 ESTABLISHED
TCP server:2781 nice21-icptl.webstore.fr:smtp FIN_WAIT_2
TCP server:2782 yi.mx.aol.com:smtp TIME_WAIT
TCP server:2784 ironport.sr.net:smtp TIME_WAIT
TCP server:2785 by2msg2263504.phx.gbl:1863 ESTABLISHED
TCP server:2789 post6.itau.com.br:smtp SYN_SENT
TCP server:2790 mail34.messagelabs.com:smtp ESTABLISHED
TCP server:2791 xl.mx.aol.com:smtp TIME_WAIT
TCP server:2793 daa21721iml001.datareturn.com:smtp TIME_WAIT
TCP server:2794 bay0-mc9-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2795 scrubber1.lcsys.net:smtp SYN_SENT
TCP server:2796 gye2.ecua.net.ec:smtp ESTABLISHED
TCP server:2797 gateway-r.comcast.net:smtp TIME_WAIT
TCP server:2798 ironport.sr.net:smtp LAST_ACK
TCP server:2799 mail.hotmail.com:smtp TIME_WAIT
TCP server:2800 mx0.prodam.sp.gov.br:smtp ESTABLISHED
TCP server:2801 gateway-s.comcast.net:smtp TIME_WAIT
TCP server:2805 yi.mx.aol.com:smtp TIME_WAIT
TCP server:2807 ns.flaglerweb.com:smtp ESTABLISHED
TCP server:2808 ironport.sr.net:smtp ESTABLISHED
TCP server:2809 bay0-mc7-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2811 mail2.hotmail.com:smtp SYN_SENT
TCP server:2812 bay0-mc7-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2818 mail2.hotmail.com:smtp SYN_SENT
TCP server:2819 mail.hotmail.com:smtp TIME_WAIT
TCP server:2821 nice21-main.webstore.fr:smtp FIN_WAIT_1
TCP server:2823 bay0-mc7-f.bay0.hotmail.com:smtp TIME_WAIT
TCP server:2832 clmboh-mx-12.mgw.rr.com:smtp CLOSING
TCP server:2833 mail2.hotmail.com:smtp SYN_SENT
TCP server:2835 hrndva-mx-14.mgw.rr.com:smtp CLOSING
TCP server:2837 mx.west.cox.net:smtp ESTABLISHED
TCP server:2838 na.mx.aol.com:smtp TIME_WAIT
TCP server:2839 mta-v1.level3.mail.vip.mud.yahoo.com:smtp FIN_W
AIT_1
TCP server:2840 xmxpita.excite.com:smtp SYN_SENT
TCP server:2841 128.177.0.201.available.above.net:smtp ESTABLIS
HED
TCP server:2842 ff-mx-vip2.prodigy.net:smtp ESTABLISHED
TCP server:2843 mx.colesys.com:smtp SYN_SENT
TCP server:2844 nice01-icptl.webstore.fr:smtp SYN_SENT
TCP server:2845 imss.aamu.edu:smtp SYN_SENT
TCP server:2846 mta-v1.level3.mail.vip.mud.yahoo.com:smtp SYN_S
ENT


-----------------------------------------------------------


Por favor, alguien podria decirme como solucionar este inconveniente?

Muchas gracias