Firewall Logs

From: Luca (nasdaq44_at_hotmail.com)
Date: 01/03/05


Date: 3 Jan 2005 21:04:41 +0100

Hi!,

in our company we have a Windows NT 4.0 server with SP6a, SQL Server 7.0 SP4
and Exchange Server.
We use this server to host our web site and mails

After Many years without problems, in the last 2 months i have noticed a
problem: sometimes, ASP pages returned this error: Server object error 'ASP
0177 : 800706ba' RPC Server Unavailable

Checking che Task Manager i have noticed that RPC Service was stopped (and
never wanted to restart without restarting the whole server)

The fact i installed the updates make me to exclude Sasser and C...

Than (today) we installed a Hardware Firewall

I have seen many interesting things (many pings, ftp access attempt...) and,
above all, i have seen that OUR SERVER was scanning many ports over the
internet

In particular the source was our server at port 1433 or 80 or 110

The fact i saw port 1433 makes me think about the Slammer Worm but we have
installed the updates.... and i also used the removal tool that did not find
anything...

In the end, the port scanning coming from the 80 and 110 port makes me
insane!!!

i do not know what to think now

Can someone act in a way that my server seems to make this port scanning
while, in fact, it is not?

Have you got any ideas?

Many Thanks

Paul