Re: Help - a possible bot

From: Jon Nelson <quincy(at)linuxnotes.net>
Date: Sat Nov 16 2002 - 09:47:00 EST

Moshe Aelion said:
> Hi everybody
>
> discovered within about 10 minutes. I then installed ZoneAlarm Pro.

Did you have a firewall before? Now that you have one you'll see how much 137/udp traffic you get, it's a lot.

>
> inspecting ZA logs, you can see a blocked scan (coming every couple of

I don't see where "...the computer immediately tries to respond" All the incoming attempts are NetBios 137/udp and the RuLaunch is HTTP (80/tcp) and not to the same IP.

>8 ACCESS,22:01:52,RuLaunch blocked from connecting to Internet
As far as the program being blocked, a google search for "RuLaunch" shows that it is Macafee, your antivirus software. It's probably checking for updates/registration.

Jon

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Nov 18 02:28:26 2002