Re: What does this log file mean- Intrusion, Noise, or ISP?

From: John S (nospam@yahoo.com)
Date: 02/18/02 

From: "John S" <nospam@yahoo.com>
Date: Mon, 18 Feb 2002 17:48:12 -0500

Thanks again for the reply. I added the offending IP to the Block List
(Restricted Zone) in NIS2002 and the alerts stopped. I have the latest
NAV2002 with updates and just scanned with ANTS trojan scanner (from
wilders.org) and no trojans found. Now that the alerts stopped I am happy,
but I may contact Charter and let them know about the IP of concern.

"guid0" <guid0@techemail.com> wrote in message
news:3c715c8d.284726625@news.uottawa.ca...
> On Sun, 17 Feb 2002 16:37:58 -0500, "John S" <nospam@yahoo.com> wrote:
>
> >NIS 2002 constantly blocks the remote IP below trying to connect to Port
> >12345 on a WinXP machine on cable. Doing a whois reveals we are on the
same
> >ISP which is Charter Communications. Any ideas why I get this alert so
> >often? Is it noise or an intrusion attempt? This appears in my log about
> >every hour. I am considering adding a rule to block all traffic with this
> >IP. Please reply to this newsgroup.
> >
> >From NIS firewall log using Log Viewer-
> >
> >2/17/2002 16:25:30:812 - Default Block NetBus Trojan horse
> >Action: Blocked Inbound TCP connection
> >Local IP, Port: xx.xxx.xx.xx, 12345
> >Remote IP, Port: 24.158.88.141, 3079
> >This port number is commonly chosen whenever somebody is asked to
configure
> >a port number. It is likewise chosen by programmers when creating default
> >port numbers for their products. It is most commonly used by the NetBus
> >Remote Administration Software. Trend Micro's OfficeScan products may use
> >this port too. Sending random data to this port or opening too many
> >connections can cause this service to crash (affects version 3.5).
> >
>
> What this means is that the person with the aforementioned ip is
> infected by a trojan and this trojan is now active, trying to ferret
> other machines to infect. Make sure you have an up to date AV on your
> machine and scan it to make sure you didn't get bit.
>
> All this means is that your firewall is working and blocks the trojan
> from your machine. You could contact Charter and report the annoying
> IP adress. They'll communicate with the person who's probably unaware
> that he/she is spreading trojan attacks all over the place.
>
>
> G.../0

Relevant Pages

  • Re: My Game Needs a Port Listed as Trojan Port
    ... > my games uses this port. ... The trojan has to be installed on your machine, ... > that my virus scan knows that this game is ok to use this port although it ... Antivirus shouldn't have anything to do with it: but for a firewall it will. ...
    (comp.security.firewalls)
  • Re: netstat finds something strange?
    ... I dunno about heuristics or viruses or trojans, ... should have your PC name as the name listening on each different port. ... > The free pest patrol scanner just looks for port numbers that are open ... >> What the heck kind of virus or trojan does this. ...
    (microsoft.public.win2000.security)
  • Re: svchost.exe
    ... Svchost.exe is tied in with RPC somehow and win2k needs it. ... If you did a netstat -an in the DOS command prompt, ... the process list and port 135 is closed and it no longer shows up on ... The trojan was listening on port ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Heres what.
    ... ANY port number. ... If there was a possibility that the system actually has the Redwood Trojan ... It is IMPOSSIBLE for anyone on the Internet to connect to the system because ...
    (comp.security.firewalls)
  • Re: Heres what.
    ... Don Kelloway wrote: ... reported port 3000-3003 being used by Redwood Broker as real proof this Trojan ... > If there was a possibility that the system actually has the Redwood Trojan ...
    (comp.security.firewalls)
Quantcast