Hiya. I just tossed out WinXP a couple of weeks ago, so this might be a dumb question.

I was running Azureus with a new firewall- I was using Guarddog, and switched to Firestarter this weekend. For the first time I noticed port 6969 was labeled Gatecrasher, and blocked. I did some Googling, and found that it is a trojan, but found very little on how to delete it in Linux.

I've also read that the port can be mislabeled (???).

Does anyone have any input on this? the Firestarter mailing list hasn't replied yet.

Thank you!

For the first time I noticed port 6969 was labeled Gatecrasher, and blocked. / I've also read that the port can be mislabeled
When infected, Gatecrasher listens on port TCP 6969. Someone made a rule for it, disregarding the fact that anyone can legitemately use arbitrary and random ports over 1024, and *listening* on a port doesn't mean it is the trojan. Traffic can be dissected in many ways, say using an IDS like Snort, because it looks for patterns in the traffic (isn't infallible, but OK). Other ways to get proof positive would (in this case) be a banner scan or simple telnet to the port. In general you would "netstat -nlp" or better "lsof -i tcp:6969" in Linux, which would give you details of what process runs connected on port TCP 6969.

All of this isn't necessary right now as Gatecrasher is a trojan for the P.O.S. (the Pitiful Operating System aka MICROS~1). It doesn't run on GNU/Linux.

You can also use
fuser 6969/tcp

to find which process is listenning on that port.

Ahhh, thank you thank you. New tools for the Great Linux Toolbox!

I'm not all too bright yet about networking, which is obvious since it didn't occur to me to just knock on that port and say, "Hey, what's up in there???"

Side note- I've been lurking here for a couple of weeks while trying to get my new PC to function properly. Everyone here seems amazingly helpful, and I hope to actually get to offer something in the future. Thanks again!

just knock on that port and say, "Hey, what's up in there???"
Well, for a trojan OK, but where this a cracker case you wouldn't want to do that. If they get alerted that way they might do stuff you would rather not have them do.


I hope to actually get to offer something in the future
I find the idea of you willing to share your hardearned cash with LQ as contributing member extremely sympathetic ;-p

OK, done. Thanks for the tip!