Re: Help - a possible bot

From: Nick FitzGerald (nick@virus-l.demon.co.uk)
Date: Sat Nov 16 2002 - 14:34:46 PST

  • Next message: Jon Nelson: "Re: Help - a possible bot"

    "Moshe Aelion" <ma0934at_private> wrote:
    
    > Two weeks ago, the NAT/ICMP computer on our LAN got compromised; the hacked
    > installed DameWare and was trying to work on the computer. It was discovered
    > within about 10 minutes. I then installed ZoneAlarm Pro.
    <<big snip>>
    
    I think there are some misconceptions here.
    
    Although ZoneAlarm should be "protecting" you, you clearly have a lot 
    of stuff configured for a machine that should be on a LAN, itself 
    protected from the real world, rather than directly on the Internet.  
    You may find the following detailed discussion of locking down 
    service bindings helpful:
    
       http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html
    
    
    Regards,
    
    Nick FitzGerald
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Sun Nov 17 2002 - 23:22:00 PST