Re: Suspicious firewall logs

From: MARLON BORBA (MBORBAat_private)
Date: Fri Aug 01 2003 - 10:05:19 PDT

Next message: Danny: "WORM_MIMAIL.A Anyone have any info on what this does yet?"

Previous message: morning_wood: "Re: RPC DCOM exploit"
Maybe in reply to: Wong Wai Kit: "Suspicious firewall logs"
Next in thread: Ben Timby: "Re: Suspicious firewall logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

i suspect some of your workstations are infected with a trojan or
something alike. if you know your workstations' addresses check them
with a updated antivirus or trojan detector.

search APNIC's whois to determine who is (no pun intended ;-)) the
owner of that addresses.

hth,

marlon.

>>> "Wong Wai Kit" <wwkitat_private> 07/31 11:16 pm >>>
Hi,
     I had one incidents which is require for your help. My firewall
keep prompting some traffiics from internal LAN IPs trying to access
this group of destination IPs for "http" service
 
208.172.144.155
208.172.158.234
208.172.128.132
208.172.192.132
208.172.224.132
208.174.16.132
208.172.13.253
 
Actually, my question is why my internal LAN(few IPs) keep trying to
access this group of destination IP for http service. My LAN if want to
go out internet, it should go through our proxy first. It not suppose go
out to external directly.
 
Thanks...

---------------------------------------------------------------------------
----------------------------------------------------------------------------

Next message: Danny: "WORM_MIMAIL.A Anyone have any info on what this does yet?"
Previous message: morning_wood: "Re: RPC DCOM exploit"
Maybe in reply to: Wong Wai Kit: "Suspicious firewall logs"
Next in thread: Ben Timby: "Re: Suspicious firewall logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Aug 01 2003 - 11:04:10 PDT