Re: Help - a possible bot

From: Mally Mclane (mallyat_private)
Date: Sun Nov 17 2002 - 23:35:08 PST

  • Next message: Bojan Zdrnja: "FTP and Win2K changed security policy"

    >> 8  ACCESS,22:01:52,RuLaunch blocked from connecting to Internet
    >> (216.49.88.100:HTTP)
    > 
    > As far as the program being blocked, a google search for "RuLaunch" shows
    > that it is Macafee, your antivirus software.  It's probably checking for
    > updates/registration.
    
    indeed, the IP belongs to mcafee:
    
    cow.ripe.net:mally:~ $ whois -h whois.arin.net 216.49.88.100
    
    OrgName:    Mcafee.Com
    OrgID:      MCAFEE-13
    
    NetRange:   216.49.80.0 - 216.49.95.255
    CIDR:       216.49.80.0/20
    NetName:    MCAF-BLK1
    NetHandle:  NET-216-49-80-0-1
    Parent:     NET-216-0-0-0-0
    NetType:    Direct Assignment
    NameServer: AUTHNSB.MCAFEE.COM
    NameServer: AUTHNSC.MCAFEE.COM
    
    If only companies would make it resolve too....
    
    
    Cheers,
    
    
    
    Mally Mclane
    RIPE NCC - Operations
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Nov 19 2002 - 20:22:13 PST