PPRuNe Forums - View Single Post - Study: Unpatched PCs compromised in 20 minutes
Old 25th Aug 2004, 00:55
  #13 (permalink)  
Blacksheep
Cunning Artificer
 
Join Date: Jun 2001
Location: The spiritual home of DeHavilland
Age: 76
Posts: 3,127
Likes: 0
Received 0 Likes on 0 Posts
exeng, Blackice logs the IP address of every intrusion attempt, what they were trying to do, how many attempts they made and what ports they were scanning. The IP address identifies the origin and, if you were really interested you could run a WHOIS on them - but why try to communicate with a computer that's trying to force entry into your own? Better to keep your head down and stay in stealth mode.

As goates already pointed out, most of these intrusion attempts are from infected computers running random scans for a response from an unprotected computer - avionics people would call it 'squitter' - scanning port 135 for the MSRPC Service for example. But in amongst the random noise are other more dangerous scans, so I'm not inclined to turn the alerts off altogether. Then there's Cool Web Search, the dreaded hijacking trojan - firewalls are useless at keeping that out as the code is embedded in the website code and you invite it in by visiting the infected site.

Just along the forum from this thread someone is complaining about having a key logging trojan stuck in his computer. Can anyone here give a good explanation of any legitimate use for a key logger?

Meanwhile I'm reading a fax of a commercial proposal that a contact sent me. Not safe to e-mail it, see...?
Blacksheep is offline