My FC3 machine appears to be compromised, please help

[Les Mikesell]

On Thu, 2006-04-06 at 14:24, Bob Brennan wrote:

> Below is the results of nslookups both ways. As you can see the
> nslookup of mi-server.net does not include the proper IP, only Mr
> Nasty's whoever it is that is taking all my email from me. What does
> http://mi-server.net deiver on the outside world? I can't see it since
> my own hosts file keeps me on my LAN.
> 
> C:\nslookup 83.104.235.34
> Server:  cache-1.ns.demon.net
> Address:  158.152.1.58
> 
> Name:    rbrennan.demon.co.uk
> Address:  83.104.235.34
> 
> 
> C:\nslookup mi-server.net
> Server:  cache-1.ns.demon.net
> Address:  158.152.1.58
> 
> Non-authoritative answer:
> Name:    wc.funnel.revenuedirect.com.akadns.net
> Addresses:  69.25.47.165, 66.150.161.58
> Aliases:  mi-server.net, wc.traffic.puredns.com

I get:
nslookup 83.104.235.34
Non-authoritative answer:
34.235.104.83.in-addr.arpa      name = rbrennan.demon.co.uk.

nslookup mi-server.net
Non-authoritative answer:
Name:   mi-server.net
Address: 83.104.235.34

And a connection looks OK:

telnet 83.104.235.34 25
Trying 83.104.235.34...
Connected to 83.104.235.34.
Escape character is '^]'.
220 Mi-Tech ESMTP server
quit

-- 
  Les Mikesell
   lesmikesell at gmail.com