Re: Help - a possible bot

From: Nick FitzGerald <nick(at)virus-l.demon.co.uk>
Date: Sat Nov 16 2002 - 17:34:46 EST

"Moshe Aelion" <ma0934@hotmail.com> wrote:

> Two weeks ago, the NAT/ICMP computer on our LAN got compromised; the hacked
<<big snip>>

I think there are some misconceptions here.

Although ZoneAlarm should be "protecting" you, you clearly have a lot of stuff configured for a machine that should be on a LAN, itself protected from the real world, rather than directly on the Internet. You may find the following detailed discussion of locking down service bindings helpful:

   http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html

Regards,

Nick FitzGerald

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Nov 18 02:37:15 2002