RE: irc port open on 6668/tcp and 6667/tcp

["Zimin, Alex" <alex () towerrecords com>]

You may have a Trojan(s) installed on these systems.
I would run fport from www.foundstone.com to identify processes
listening on these ports.
Scan system with AV software of your choice (try Kaspersky AV -
www.avp.ru)  and/or Trojan removal software:
The cleaner - http://www.moosoft.com/thecleaner/
Ad-aware - http://www.lavasoft.de

Alex.
> We are having two NT 4 domain controller servers, PDC
> & BDC. 

> Recently I was trying nampwin 1.3.1 and found that out
> of these servers, PDC has open tcp port on 6667 & 6668
> for irc. 

> Now my question is, why these port are open on PDC? Is
> there something suspicious? What should I do to find
> the exact reason?