Re: Portmap / Port 211

From: Bee BeanGuy (brtok@yahoo.com)
Date: 01/16/02 

From: "Bee BeanGuy" <brtok@yahoo.com>
Date: Wed, 16 Jan 2002 01:58:41 GMT

Hey;

Dumb question? Where are you reading this? Which log..forgive my
ignorance!!!

B
Jester <admin@eziekiel.com> wrote in message
news:3c08784f$0$12226$afc38c87@news.optusnet.com.au...
> I have been getting a few of these. Started showing from 3am this morning
> est
>
> 07:09:15 input ppp0 TCP 203.197.92.82
> 111(SUNRPC)
> 111(SUNRPC)
>
>
> Regards
>
> Andrew
> "$uRoot" <admin@bogus.thinktankdecoy.com> wrote in message
> news:9u9pis01adn@enews2.newsguy.com...
> > Has anyone else been seeing connection attempts on port 211 pop up over
> the
> > past week or so? I've started noticing quite a few entries in my logs
> from
> > machines trying to connect to port 211 (portmap). It's not like I'm
> getting
> > scanned, as I'm only seeing 2-3 entries per IP & they're specific to
port
> > 211. I'll see a few here, few hours later see a few more. Hadn't
noticed
> > this much activity before. Was wondering if there was a worm or
something
> > going around that I hadn't heard about. One of the failed attempts
> tonight
> > was from a box owned by Electronic Arts - that's why I'm wondering if it
> may
> > be a worm of some kind.
> >
> > Thanks.
> >
> >
>
>

Relevant Pages

  • RE: [Full-Disclosure] RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
    ... Subject: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434! ... Seems to be the most common opinion of those who have no apparent experience with large networks. ... held no responsibility here, ...
    (Full-Disclosure)
  • RE: Remote Desktop vs VPN on Windows 2003
    ... > default SQL port to anything else, they would have never been touched by ... risk posed by slow insidious attacks when defenders are always facing off ... > characters) to prevent every SQL scanning worm in existence. ... > security through obscurity doesn't work, when clearly it does have its ...
    (Security-Basics)
  • Protecting Home Machines
    ... It also opens ports between port 666 to port 765 for its malicious ... Similar to the earlier MSBLAST worm variants, ... I recommend Sygate Personal Firewall ... internet connections. ...
    (Security-Basics)
  • Re: Zonealarm Netbios name on port 10xx messages ??
    ... > i use also tiny personal firewall on Win98. ... Probably the opaserv worm. ... just quoting the port it orginates from. ...
    (comp.security.firewalls)
  • Re: SQL Worm
    ... >will allow a connection to port 1433. ... I'm guessing that the worm has been modified and ... >password on the SA account. ... >access to port 1433 for most internet hosts except for certain subnets ...
    (microsoft.public.sqlserver.security)