No scaremongering, but ...

I had about 3000 alarms in the last 3 days from my PC being scanned.

Looks like another trojan becoming active ...

Just make sure that you have some kind of protection on your PC. ZoneAlarm is pretty good and free, but others may be equally useful.

See

 

Its good to keep reminding people!

Had a consultant at work this week who complained about a lot of data being sent down his dialup link (which he left connected all day).

It had transferred over 100mb -
netstat -na revealed over 5000 open ports. On reboot, over 2000 ports were opened immediately.

He had a trojan, hadn't updated the virus files in 6 weeks and had no personal firewall. Told him to talk to his IT dept who told him that the laptops were 'self managing' ie he had to do it himself!!!

Regularly updated virus checker plus personal firewall and regular patching isn't just for those of us who run servers....

 

nah ur ok theo - not scared....

 

OK, just to update ... all scans seem to go to port 80, so it may be the Code Red thing relaunching.

If you are not running IIS, you don't have to worry about this one. Still, recommendation of a personal firewall still holds.

Theo

 

Theo,

it is not so much a <I>relaunch</I>, rather just a continuation of the damage that Code Red II is doing. See

 

most of the connections to port 80 at the moment will be code red, or one of its variants/children.

i'm seeing &gt;50 attempts per day.

depends on your ip address: a mate's server is getting 200 attempts per day.

oh well, only 10 days of it to go (until the 1st Sept, anyway).

cleanup of code red 1 is easy as its memory based only: reboot, then patch to stop re-infection.

code red 2 is a bit more tricky....plenty of sites with the info needed though.

 

Reading some of the MS Private newsgroups, Code Red seems to stop the MS Proxy services on BackOffice SBS servers at random.

Interesting side effect...

ChrisB.

 

*Groan*

Editted as I read the help file

[This message has been edited by Ian Griffiths (edited 10 August 2001).]

 

So tonight was a good time to change over to my hardware firewall then?

 

i have had zone alarm and norton av for a while now and i am extremely happy with both.
ZA is certainly good for a freebie !

VM