Defcon8 2.1

Hey y'all
I got a sub/seven trojan alert on my firewall, and I port scanned the IP it came from. My portscanner found all kinds of open ports. This is interesting (at least to me). Port 1960 was open. My port scanner had this message reference port 1960:

port 1960 connected.time/date: 00:59:59 March 3, 2002, Sunday version: DEFCON8 2:1

I put DEFCON8 in my search engine and it seems it's some kind of sub-seven trojan version. Is that right? Does this mean the 'puter that attacked me is running this trojan on port 1960? And does that mean it's probably a "zombie" some cracker is using to run attacks through? Let me know what you think.

i think i would agree with your assumption..it sounds pretty logical to me. What i would do is find out who the ip address is registered under and then contact someone there and let them know that remote access was attempted to your computer from that ip. You can say that you scaned it and found some trojan ports open [ should have to worry about them going insane because you scaned it because someone tried to gain remote access to your computer...who wouldnt scan it ]

or just leave it open and if it ever happens to me i will be sure to let someone know.

On a semi-related note:
last night i finally got black ice for xp and put it on my computer and right away started blocking a hell of alot of stuff. I am running winxp and am still in the proccess of closing ports and **** like that ....anyways.. Netbios was open at the time and i kept on getting request to my netbios port with computers named OEM and Party something. I traced the computer that had something to do with party in the name back to prodigy and reported it [ still waiting for responce ] and the one labeled OEM was comming from the U.K. didnt do anything about that one yet.

Hey Euclid,
Glad you've got a firewall, but I've heard Black Ice has some problems. You might want to ask some of the more experienced people around here what they think.

Also, you might want to see about totally disabling NETBIOS.