Windows Server 2000 anomalies

[S1ID3R]

ok we had a strange thing happening here yesterday, we are running a few servers, with windows 2000 server, all patched and with the appropriate updates, however, yesterday we were made aware that:

"complaints that we are receiving related to apparent CodeRed type TCP port 80 activity (which could of course be web server break in attempts under the control of a human user, rather than virus or worm related activity)."

however a full virus scan of the machince revealed nothing, the other option was:

"TCP port 4889 may be used by the ICQ protocol, so the TCP port 4889 scans could be the result of someone attempting to "spamvertise" using ICQ mass messaging techniques."


if ANYONE has any idea how to stop this happening, or what exactly it is, please let me know as soon as possible.Cant seem to find anything obviously wrong with the machine. Thanks a lot.

 

[jrbarnett]

Hi

Have you run a full port scan against your servers to see what is open (and therefore possibly transmitting or receiving data)?

John

 

[ChrisHirst]

this was a news item yesterday, your server may be targeted.

Just a possibility


Chris.



Indifference will be the downfall of mankind, but who cares?