On 18 Jan 2004 01:12:17 -0800 "Daniel H. Renner" <[EMAIL PROTECTED]> wrote:
> ICMP PING CyberKit 2.2 Windows This is how snort detects blaster's/nachi's attempts to ping an IP in order to check if it's alive, before trying to connect to port 80. Could be another variation of the blaster worm.I would check (Also snort may detect Cyberkit's 2.2 packets as well, but i suppose that is something you would know of). If the packets are incoming, it is a normal thing that i witness in snort's logs as well very often. Actually, i have removed the rule from snort's rulesets, because it used to fill my logs with cyberkit attempts :P. If it is outgoing traffic, i would suggest that you should run trend's housecall (free online antivirus) on the windows servers/workstations of your network. Also... gateway.dll is because of msn chat. If you add a deny acl for gateway.dll in your squid.conf, your workstations won't be able to use msn chat any more. Giorgos Adamopoulos _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
