Larry,

perhaps you can get more detail if you issue

inetd.net.sys -l (lowercase L)




Larry Simonsen wrote:
> we are getting these messages on our console, about 10 per minute.
> 23:47/#J440/280/getpwnam: USER.TFTP: No such user
> 23:47/#J440/223/getpwnam: USER.TFTP: No such user
> 23:47/#J440/219/getpwnam: USER.TFTP: No such user
> 23:47/#J440/220/getpwnam: USER.TFTP: No such user
> 23:47/#J440/114/getpwnam: USER.TFTP: No such user
> 23:47/#J440/205/getpwnam: USER.TFTP: No such user
> 23:47/#J440/98/getpwnam: USER.TFTP: No such user
> 23:48/#J440/214/getpwnam: USER.TFTP: No such user
>
> is there any way to locate the offending host/PC?
>
> i think it is some kind of a virus and needs to be cleaned.
>
> -------------------------------------------------
> Larry Simonsen
> Sr. System Analyst
> Flowserve Corporation
> 505 E. Technology Ave.
> Bldg. C, Suite 3100
> Orem, UT 84097
> Phone: 801-437-3737
> Fax: 801-491-1750
> -------------------------------------------------
> All opinions expressed herein are my own and reflect, in no way, those of 
> my employer.
> -------------------------------
> NOTICE:  The information contained in this e-mail, and attachment(s) 
> thereto, is confidential and may contain attorney - client privileged 
> communications. If you are not the intended recipient, you are hereby 
> notified that any dissemination, distribution, or copying of this 
> communication is strictly prohibited. If you have received this 
> communication in error, please notify the sender immediately and delete 
> the e-mail from your computer system without retaining any copies. Thank 
> you.
>
> * To join/leave the list, search archives, change list settings, *
> * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
>
>   

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *