>From our experience, that signature has a very low false positive rate. It almost >certainly indicates that an attack is in progress. Since you are getting a lot of >these, I suspect that one of several active worms is trying (possibly successfully) >to break into your systems. If the intruder is within your own network, you likely >have an unpatched and infected system.
-----Original Message----- From: Witkowski,Tytus,WARSAW,GLOBE IT-CC [mailto:[EMAIL PROTECTED] Sent: Thursday, October 09, 2003 4:15 AM To: [EMAIL PROTECTED] Subject: [ISSForum] MSRPC - events Hi All On our one network sensor (7.0) inside windows network I receive a lot of events with description MSRPC_RemoteActivate_Bo. Is it connected to MSOutlook client which start communication with Exchange server (port 135) or is it some kind of MSRPC vulnerability (unpatched PC, infected PC)??? br Tytus Witkowski _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
