Benoit Panizzon wrote:
As of today, cybernet started blocking port 135/tcp on the whole network.
So I wonder, is there a new worm or virus that those ports get blocked? How do other ISP handle such situations?
This Port is used for MS-RPC, and was missused from W32.Blaster/Lovsan and is still being missused from W32.Welchia/Nachi worm. I have hits of this worm almost every minute on my ADSL router at home, where I block this port.
In the log I see, how the worm is checking all of my public IPs through.
bye Fabian
---------------------------------------------- [EMAIL PROTECTED] Maillist-Archive: http://www.mail-archive.com/swinog%40swinog.ch/
