Someone sent a NET SEND message to the remote terminal. However, from the information that you have provided, there is no way to know what has happened. Are MACHINE1 and MACHINE2 on different networks? What do the firewall logs indicate at this time? If there is a firewall, and the machine from which this originated is on a different network, that would lead me to believe that something is wrong--determining exactly what that "something" is will require some administrative detective work. Can you post some additional information? Perhaps something from a firewall and/or the event log? Cheers Keith -----Original Message----- From: raymond simon [mailto:desperate_straightsat_private] Sent: Tuesday, February 05, 2002 3:55 PM To: incidentsat_private Subject: We Are Past Your Firewall... A friend of a friend sent a screenprint of a popup he received when connecting to a network share. The text reads (Sanitized): Messenger Service Message from MACHINE1 to MACHINE2 at TIME We are past your firewall and can see you are on as your administrator. Are you concerned? (I would be) Anyone recognize this? __________________________________________________ Do You Yahoo!? Send FREE Valentine eCards with Yahoo! Greetings! http://greetings.yahoo.com ------------------------------------------------------------------------ ---- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Feb 05 2002 - 13:30:21 PST