Port Scans from Outside

[JSE73]

ISA is reporting that it is being port scanned by outside IP addresses. It happens a couple times a day.

I've done my own scans and I'm confident my server is secure.

Should I be concerned by this? Is there something I should do about it?

 

[joeb1kenobe]

If you don't know who is scanning you, I would definatly investigate the scans. Although, you may think that the server is secure, there are always new flaws/vulnerabilities that you may not know about. If you are seeing a scan a couple times a day, someone is certainly checking out your ISA server. Probably using NMAP. You may want to do a reverse lookup on the ip address in you log, and give the company a call regarding the scans. It may stop an attack before it happens.

Joe

 

[JSE73]

Thanks for the reply.

This may be a dumb question but, how do I do a reverse lookup?

 

[Marvin88]

I am investigating a port scan that is coming from 127.0.0.1-the local machine. I happens a couple of times a day as well.

 

[joeb1kenobe]

Go to

http://www.psacake.com/web/eg.asp

and type in the IP address. This will give you the necessary information to find the ISP responsible.

Joe

 

[Corr]

I too have been receiving port scans from 127.0.0.1. The thing that sucks is it emails my cell phone with these alerts. I get no sleep. After many moons of trying to figure it out......I finally said screw it. Well, I skimmed the Firewall Logs again and noticed the following;

A program called AutoProxy is trying to acces the IP: 127.0.0.1 and Port:#### (these seem to be random ports, hence the alert seeing it as a scan)

Well...I found what IP they were coming from. I went to the Internal machine and found the following as well:

In the registry:

HKLM/Software/Microsoft/Windows/Current Version/RUN/lzfqndc.exe

I deleted the key....it came back immediately after a refresh.

In the System32 folder:

lzfqndc.exe and .dll

I opened the DLL file with wordpad and at the bottom of the file it mentioned Autoproxy. So I rebooted into safemode and removed the registry key and deleted the two files in System32.

I am waiting to see if that was the cause. So far I have not received an alert yet.

Sorry for the long winded story, but I had lot's of coffee today.


Regards,

John
Crystal River, FL