Re: exchange server attempting to connect to odd ports
From: Jonathan Glass (jonathan.glass_at_gmail.com)
Date: 07/06/05
- Previous message: Marc Fossi: "SecurityFocus Microsoft Newsletter #247"
- In reply to: Matt Bazan: "exchange server attempting to connect to odd ports"
- Next in thread: Martin Pescasio: "RE: exchange server attempting to connect to odd ports"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 06 Jul 2005 10:24:38 -0400 To: Matt Bazan <Mbazan@onelegal.com>
Matt Bazan wrote:
>Just rebuilt our exchange box and I see it trying to open connections to
>the following udp ports:
>
>1140
>3069
>
>This is happening to a 192.168 IP address so it's not getting far but I
>find it curious. Happens every minute or so. Have scanned for spyware
>and run AV software on the box and both have come up empty. Any other
>ideas? Thanks.
>
> Matt
>
Download and run seccheck.exe from
http://www.mynetwatchman.com/dl/seccheck.exe (read the following page
for info on the tool: http://www.mynetwatchman.com/tools/sc/). It'll
spit out a seccheck.log file showing all active processes and network
connections. Go through the network connection table until you see the
process making those connections, then determine (google,
processlibrary.com) whether it is a normal process.
Jonathan
---------------------------------------------------------------------------
---------------------------------------------------------------------------
- Previous message: Marc Fossi: "SecurityFocus Microsoft Newsletter #247"
- In reply to: Matt Bazan: "exchange server attempting to connect to odd ports"
- Next in thread: Martin Pescasio: "RE: exchange server attempting to connect to odd ports"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|