From: "Geo." 

"Hrvoje Mesing"  wrote in
message news:409acd0a{at}w3.nls.net...

> Still, if there is _up.exe ran again, there is active 9996/5 port
> though which you can drop directly to shell. With telnet.

I don't think so, I think the initial stage one (the overflow exploit)
opens the port not the up.exe part that is downloaded via ftp.

it's like trying to catch a computer while it's booting. Not impossible but
not real easy either.

Geo.

--- BBBS/NT v4.01 Flag-5