If you check the source IP, you will find that this device is infected with the Welchia virus or somebody is performing scans from that IP for the MS-039 security patch.
Glenn A. Townson -----Original Message----- From: Witkowski,Tytus,WARSAW,GLOBE IT-CC [mailto:[EMAIL PROTECTED] Sent: Thursday, October 09, 2003 9:54 AM To: [EMAIL PROTECTED] Subject: [ISSForum] MSRPC - events Hi All On our one network sensor (7.0) inside windows network I receive a lot of events with description MSRPC_RemoteActivate_Bo. Is it connected to MSOutlook client which start communication with Exchange server (port 135) or is it some kind of MSRPC vulnerability (unpatched PC, infected PC)??? br Tytus Witkowski _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
