Re: Agnitum Log entries

From: \ (dvader_at_deathstar.mil)
Date: 08/29/03 

Date: Fri, 29 Aug 2003 12:39:20 -0400

Those are echo requests from the oh-so-popular Welchia virus. They are no threat
themselves, just an annoyance. If they get a response, the next step is to try
to exploit a vulnerability in the Window RPC controller, port 135. If you are at
all diligent, that should have been patched by a visit to Windows Update a month
ago. In any case, your ISP is probably already blocking that port, even if you
aren't, but if you are using Outpost, you probably are. Many ISP's have taken to
blocking ICMP traffic, as well. Don't be surprised if these pings suddenly stop.
To relieve log clutter, disable logging for that event. Ignorance is bliss. :-) 

-- 
Dave "Crash" Dummy - A weapon of mass destruction
crash@gpick.com
http://lists.gpick.com