Hi friends,

Port No.119 is NNTP Port, right?.. Well, when I chat throgh Yahoo messenger, why my computer get connected through this port... I have heard that one trojan named "HAPPY98" etc works through this port, but, I dont think that trojan is there in my computer. Yahoo's port is usuallay, 5050, right?.. You know, when I stopped the firewall (ZONE ALARM), I could see remote machine got connected to my system through FTP Port 21..!!. Well, I feel like something is wrong in my computer, I have free AVG version antivirus installed.. My system goes slow too while chatting through Yahoo... Can anybody give an explanation in this case?..

you may need more information, Well, my OS is Win 2k Pro. Is there any exploits in that port?..

Thanks in advance
Manu

hello

probably you might want to visit www.ntutility.com and get
the active ports program from there - it shows you what
ports are open to where by which application ....

helps sigificantly to track down unwanted apps.

regards,
ulrich

check out this and all your problems gone ..

aTa

download tiny firewall... there you can see what app is using what port

Hey guys,

I am using ZONE ALARM...!!. I think, when my brother was trying to chat through yahoo or what should I say, he might have given YES permision when ZONE ALARM poped up that an application wants to connect thgough port no 119.. I didnt do it, I just want to know, is there any trojan or anything which uses 119 to exploit ... Hey, I think you got my question.

Manu

@Manu
look at this http://www.blackcode.com/trojans/ports.php
There is only one trojan using this port: HAPPY98 .

and look here for some infos about the port:
http://www.seifried.org/security/ports/0/119.html

another method is a remote trojan scan:
there's a good one at: http://scan.sygatetech.com/
otherwise i'd need more info to help you.
regards,
u.

Yahoo Messenger uses port 119 by default, along with a ton of other ones.

To quote the website, http://www.shockley.net/ipf-block-aim.asp :

Problem is, I notice a bunch of odd connections on odd ports going through the firewall. (It's not often a finger connection stays open for hours.) Turns out, if AIM can't connect on port 5190, it tries a bunch of other ports to try to get through. Little-used ports like ftp, http, nntp, etc.


You can always run ethereal to monitor the traffic going over that port to see if it's Yahoo or trojan related.

Hope this helps.

google.com

Guys,

Like dfs said, I think, Yahoo uses Port no 119 too... I think so... I am not sure, Anyway, no problem happend yet.. Still I could see the port 119 is connected when I chat with YMSGR.. I used to see port no 5050 when I chat, but now It is changed.. What ever, it is not HAPPY98 Trojan anyway.. Well, thanks a lot guys, let us burry this topic..

Peace.,
Manu