Compromised BIND?

[Stephane Bortzmeyer]

On Tue, May 31, 2011 at 02:38:13PM -0400,
 Supersonic <wbpfsguy at gmail.com> wrote 
 a message of 38 lines which said:

> My firewall is showing repeated attempts by named.exe to connect to
> IP addresses in foreign countries on ports 6666, 6667 and 6669

Not enough information to decide. For instance, what was the source
port of these packets? If it is 53, it may simply be BIND answering to
requests having the source port 6666.