ISA Server: Spoof attack from 127.0.0.1?

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - ActiveX Controls I get the following message from Microsoft Internet Explorer: "Your current security settings prohibit running ActiveX controls on this page. As a result, the page may not display correctly." I have enabled all 5 ActiveX controls, done many things suggested by AOL & Gateway. Nothing has worked. I am running Windows 98 with Road Runner and AOL. My AOL Calendar does not display and I get the same message there. Any ideas? Thanks Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30208
  - 2
    - updating??? Somebody PLEASE help me. The microsoft site tells me that my Windows 98 is no longer supported and I should update but I have no idea how to do that so I can get rid of whatever is causing me to get kicked off all the time. Can anybody help? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30199
  - 3
    - Hot fixes and n-case I have downloaded the hot fixes from windows. They are taking up a lot of space on my computer. Do I remove them or do they need to stay to continue to work? I am also getting this message "The system has detected that a third party application has removed n-case" They are asking to reinstall. What is n-case and what do I do? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30196
  - 4
    - XP Firewall and Yahoo Chat When trying to use Yahoo Messenger Chat to view a webcam or to use voice..... it tells me that it can't do that because I am behind a firewall... however I have it disabled.... where do I turn next? Thanks Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30184
  - 5
    - Returning gobs of e-mails hello, Everytime I open MS outlook express I have dozens of e- mails that I never sent returned to my box. The failure notice claims I sent them, but I di not, the sent items box does not show them and 99% if them the addresses I have never even seen before. Any ideas???? Thanks Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30182
  - 6
    - Frequency Waves Is it true that placing a portable phone too close could damage a computer? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30177
  - 7
    - ActiveX controls When surfing the net, I get pop up windows asking if I want to allow ActiveX content and warnings the the page is trying to access an ActiveX script. Where do I go to stop this from happening? Thx Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30176
  - 8
    - Dssagent.exe messing with my shutdown?? Iam using windows ME and noticed that my shutdown takes forever. But when I <CNTRL ALT Delete> and END task for HOTKEYS,and MACROS... then RETRY shutdown... which works. I noticed that DSSAGENT.exe is running...used MCAFEE to delete it. But like a bimble it came back? What is DSSAgent?? Many thanks!! Regards Joe D. Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30168
  - 9
    - Q823718 MDAC Patch Has anyone deployed this patch and encountered problems? I pushed it out last night and now I cannot log into half my systems! you can ping, map drives, even acces resources like webservers, but no local log in. I have 600 plus systems. HELP! Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30167
  - 10
    - Upgrade MDAC to version 2.8 vs MS03-033 Patch Greetings, I manage a domain with Windows 2000 Domain Controllers, Exchange 2000 running on Windows 2000, 2000 Professional on all of the desktops, and a handful of NT 4.0 servers either running SQL Server 7.0 or Oracle applications. I'm not sure if this is significant, but I'll also note that we have a few member servers and clients running Microsoft Great Plains eEnterprise version 6.0 (soon to be upgraded to version 7.5). At that time we will also be updating our SQL servers to SQL Server 2000. I was set to apply the MS03-33 patch to all of the Windows 2000 Server and Pro systems, but we have a staff member proposing the alternative of upgrading MDAC to version 2.8, in lieu of patching. The logic here is that version 2.8 is not at risk from the exploits addressesed by the patch. My preference is to apply the patch and not to update. I'm looking for other opinions here. Is the update to MDAC 2.8 a suitable alternative? The NT 4.0 servers are running MDAC version 2.1, which is not addresses by the patch. Would it be better to update them to version 2.5 and then patch or go straight to version 2.8? Thanks in advance, Alan Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30165
  - 11
    - Did Sobig spread by clicking on a link? There's this story going around: "Sobig.F was released last Monday on a sex-oriented Internet discussion group, infecting computers when users clicked on what appeared to be nude pictures, experts from several security companies who had seen the site said." Other versions referring to it as a link instead of a nude picture. So this begs the questions: Did the Sobig initial spread by just clciking on a link? So am I at risk anytime I simply click on a link? TIA Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30163
  - 12
    - blocking websites is there any way of blocking websites adding themselves to my favourites list and sending me web pages since website like casino websites continuosly add themselves to my favourites, adding desktop shortcuts and also web pages keep ramdomly appearing on my screen whilst trying to surf the web in peace thanks Tom Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30152
  - 13
    - Windows application event message queue and callback security How can I stop or detect when another application is monitoring or is modifying my message queue or subclassing my app controls? Ie., somehow detect or prevent when a program like spy++ is watching my messages or an injector is pumping in messages or somehow changed the callbacks. Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30147
  - 14
    - Patch vulerability in NT Is there a patch whereby you can patch the new virus vulerabiliity in NT workstatation 4.0 without needing service pack 6? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30141
  - 15
    - cipher strength 128 bit hi iam using ie 5.0 with cipher strength as 56 bit. i need to download cipher strength 128 bit. do i need to download ie 5.x or greater? is there any way to update cipher strength 128 bit with downloading the higher version of ie? pls help thanx Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30140
  - 16
    - Administrator Dear Expert, I accidentely made myself a limited user and deleted "Computer Administrator". How can I recover the "Administrator", I am the Only user Of this Computer? Werner Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30135
  - 17
    - popups i keep getting pop ups from "messenger service" telling me to contact www.byebyeads.com. i am running norton internet security. virusscan finds nothing. please help. ben Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30130
  - 18
    - e-mail request ostensibly from Microsoft to download a patch I've gotten two messages ostensibly from microsoft that my computer warns me lack an Autheticode sinature. The message is from"microsoft"<security@microsoft.com> the return path is<admin.duma.gov.ru> Is this a legitamate message from Microsoft? Thanks Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30122
  - 19
    - latest critical update help pls i am unable to download the latest critical updates from the microsoft update website 822925 and 823718 can anyone shed some light on this pls. im running windows xp home edition all other updates are to date Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30118
  - 20
    - cookies Does anyone know if I do not visit a website but a "pop- up" ad is sent, will this still create cookies? From what I gather, the cookies are only created when you visit a certain web page or site. Is this correct? (suspect someone of visiting porn sites - according to the files in cookies!) Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30097
  - 21
    - E-mail Alerts from Win2k Server Hi, I was just wondering if anyone out there has any preferences to system security applications for windows servers? I am looking for an application that will be able to e-mail Sys Admins when something has gone wrong, and also possibly the system logs on a weekly basis? thanks, - Lenny Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30094
  - 22
    - 98SE firewall with dial-ip Any sugestions for a downloadable firewall (I have AVG for virus protection) with 98 Second Edition operating system and dial-up internet connection? Thanks for any help you can give, guys, Kent Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30092
  - 23
    - The sobig worm and ME I have read the articles and I hear the claims that it does NOT affect windows ME.... this isnt true. My PC is suffering fromt he same effects that the others are, that possess this worm. I need some help. Any advice as to where I can find a patch to delete this nasty bug? Is it going to come down to me reformatting this PC? Are there any solutions for ME, or is it not a recognized problem yet? Please help if you can. Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30089
  - 24
    - Windows 98 SE How can I lock windows? I do not have dial up, and I would like to know if there is a way to only open windows with a password. Thank You, Emma Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30086
  - 25
    - list.....these are blocking good 4.40.20.65 4.72.69.69 12.213.175.149 24.169.249.251 24.174.251.233 61.25.177.140 61.185.205.121 62.234.18.155 62.254.76.81 62.255.41.20 64.119.68.121 65.26.220.218 65.27.224.181 65.94.115.215 66.131.219.38 66.177.43.246 67.73.34.91 68.120.91.160 69.144.163.230 80.221.9.19 81.86.222.112 81.107.100.212 82.37.34.15 82.145.229.105 134.217.237.30 142.173.58.75 172.200.126.212 198.142.210.122 202.156.166.228 203.12.160.33 212.47.242.72 218.145.25.112 218.253.64.154 Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30083
- Next
  - 1
    - Pop up Messenger hi, i recently restored my windows and now when i connect to internet after every 2,3 minutes i get a secuirty popup messege from windows messenger that my ip os being broadcasted, can any one help me with this Thanks, Masood Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30081
  - 2
    - Help please XP + Norton Internet Security Ive Just updated my antivirus using Norton Internet Security Ive hap windows XP for over a year with no problems untill now. I cannot read my floppy disk drive or cd drive. Any Ideas please. Ian Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30080
  - 3
    - Windows Update CD Recently I had to rapidly develop and package a CD for home users to install Windows security related software updates. We have been developing CD's in the past for technical users which include patches and minimal documentation. I know where to download required service packs and hotfixes that can be placed on a CD. Unfortuntely, home users require more detailed instructions that can be easily followed. Microsofts Windows Update website is ideal for users with high speed Internet, however this is not practical for people with dialup or no Internet access. Any ideas on how a standalone Windows Update CD could be developed which is similar in idea to Microsoft's Windows Update website (http://windowsupdate.microsoft.com)? That is, a CD that can be delivered to users that would scan the computer for missing security related software updates and allow a one button install of all thats missing? There should be the assumption that the computer will not have Internet access. I expect that this could use hfnetchk/mbsa with a mssecure.xml file on the CD to detect whats missing. Any ideas how this can be integrated onto a standalone CD with a user friendly interface in a way that it could be used a template and updated with new packages as required? Brian brian_anon@hotmail.com Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30074
  - 4
    - help update security problem I have Windows XP Professional and recently took the computer in because of the worm where it constantly rebooted within a minute. I realized then that the updates from microsoft that I had downloaded all failed prior to the worm and now, afterward. What goes? Pat Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30063
  - 5
    - XP Firewall I'm wondering if the firewall that is included with XP Home Edition is a good one or should I purchase Norton or McAffee. Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30061
  - 6
    - IP address/Media disconnected I wanted to run a security check. It told me that my IP address was different than what I said. When I tried to check my IP by (running winipcfg), under IP address it has "Media Disconnected". What's going on? What should I do? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30056
  - 7
    - Changing Passwords I am new to WindowsXP. How do I change the password for the Internet access. Could someone give me a step by step guideline please? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30049
  - 8
    - IM spam Hi Is there a patch to block IM spam? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30037
  - 9
    - folder security rights we are just moving to a domain network, what is the best policy for assigning security rights to files and folders, should I delete the everyone group and give access to "domain users" or a custom group called "staff" etc, also we have 4 users that should have admin rights, should we use "administrator" as the main user or add each user to "Domain Admins" group and get them to log into servers as themselves so the changes can be monitored-but wont this create multiple profiles on the servers?-whats best? we run Windows 2000 servers. Thanks for your help Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30029
  - 10
    - HELP wich one is better (stable , & grafical interface)??? Redhat 8 or 9???? reply at drweed551@hotmail.com Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30019
  - 11
    - NEED HELP IMMEDIATELY PLEASE I need to know how to clean sweep my hard drive. Is there a download somewhere I cam get for free or purchase on line and download it? I need to do this ASAP Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30018
  - 12
    - How to proof high encryption is being used? Microsoft provides high encryption with at least 128 bits symmetric key after installing the high encryption pack. However, is the high encryption option is used by default after installing the pack, or should I need to do some setting to enable it? And how can I prove enough bit key is being used? Many thx. Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30007
  - 13
    - RPC service 1394 Preparing to enable the internet firewall on my windows xp 2003,when in internet connections to protect the particular connection in current use ,I found enabled in the LAN/high-speed catergoy this internet adapter 1394,but i am actually using the aol dial up connection to reach the net. is something amiss in all this Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 30001
  - 14
    - Unwanted Toolbar in IE My son downloaded a toolbar into IE. It is a sex related toolbar and I can't get rid of it. How do I get rid of it. Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29990
  - 15
    - Account Passwords and Policies security chat The chat is this Tuesday. Please attend if you're interested! Details are below. Account Passwords and Policies Come for a chat with the writers of the Account Passwords and Policies paper. Bring your questions about password and policy lockout settings as well as configuration and troubleshooting lockout issues. The writers and other subject matter experts will be online to help answer your questions and solve your issues. We are also interested in hearing whether this paper addresses and solves your issues and if not, what is this paper missing. We also want to hear what you would like to see done better in the docs. This is your chance to tell us how we are doing in regards to documentation. Link to paper: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/maintain/operate/BPACTLCK.asp August 26, 2003 10:00 - 11:00 A.M. Pacific time 1:00 - 2:00 P.M. Eastern time 17:00 - 18:00 GMT 18:00 - 19:00 BST -- -Mike Danseglio Microsoft Corporation * This posting is provided "AS IS" with no warranties, and confers no rights. * Please note I cannot respond to email questions. Please use these newsgroups. Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29974
  - 16
    - How "strong" are CryptoAPI RSA keypairs RSA keypairs can be generated via CryptoAPI with keylengths from 384 to 16,384 bits, with 1024 and 2048 being the most common commercial keysizes, depending on what CSP is available. RSA keygeneration is exposed in CryptoAPI via CryptGenKey() and other wrapper utilities like makecert.exe etc... Is there any published information on how Microsoft CryptoAPI implements the RSA keypair generation procedure internally (i.e. how entropy is used in the generation process) ? - Michel Gallant MVP Security Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29968
  - 17
    - Windows Update and McAfee VirusScan:problem or virus? Yesterday, McAfee did a complete update on their VirusScan Online. Ever since then, after I have completed Windows update for critital updates or Windows XP software updates ( and it has come up with none in both cases), a pop-up from McAfee VirusScan has appeared: A SUSPICIOUS SCRIPT HAS BEEN DETECTED! The file (in bold) C:/WINDOWS/PCHEALTHCTR/BINARIES/helpctr.exe contains suspicious scripting activity and has been stopped. I am given the option of stopping it permanently or allowing it. Naturally, I have stopped it for now, what with MFblaster and the SoBig viruses about. McAfee has been no help! They suggested I download their FreeScan at their website to determine if my computer and their VirusScan online had been corrupted. Please help! Can you tell me if that is a valid script for Windows or virus Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29965
  - 18
    - SECOND WAVE Of Attack From Sobig Worm! **URGENT** A second wave of attack from the Sobig-F Worm is imminent! This has ONLY come to light in the last few hours... PLEASE READ the following: http://www.updatexp.com/sobig-attack.html Do take this warning seriously folks.... Kind Regards Marc Liron www.updatexp.com Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29953
  - 19
    - At Scheduling Permissions on a remote system I am scheduling a task via AT or the GUI (sched tasks). The AT command points at a .bat file that then calls a .bat file on a remote file systems I have tried using a drive letter and UNC and have tried various permission options on the remote file system. I continue to get "access denied" when trying to invoke the remote file. The batch files both work when called from the desktop and runs as the local logged in user. The issue only occurs when trying to use AT. I realize that the AT service runs as the user "system" and have tried to change AT to run as another user which does not seem to be possible. What permissions to I need to add to the remote file system to make the above work? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29942
  - 20
    - Port 2048 STILL Well it's been a few days now and still no one has any idea what's going on with regards port 2048. I've been online for a little over an hour and I've had 966 hits on that port. It's not getting through but I'd just like to know why I and quite a few other people are getting hit all the time. Is there yet another flaw in MS's os?? Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29935
  - 21
    - ** Sobig.F attack expected 3:00pm to 6:00pm EST today [Friday 22] Relatively new information about the Sobig.F worm activity happening TODAY: Around 3:00pm to 6:00pm today EST, Friday 22 August 2003 and Sunday 24 August 2003, computers that are currently infected with the Sobig.F worm will be directed by the worm to connect to the Internet and then download and run a mystery program. No one knows what this program will do. AFAIK, the virus authors are not making the download executable available until the attack begins. Antivirus updates downloaded August 19 or later should detect Sobig.F. The Sobig.F worm is believed to use the ports UDP 8998 as well as 995 through 999 UDP [the former for command and control outbound from the infected device possibly involving the "master servers," the others opened and listening inbound on the infected workstation]. There is a list of the host names and IP addresses the ones the worm will attempt to download from, but this list is not yet public information as far as I know. Reportedly it may be on www.google.com/groups, but I didn't see it when I searched. Sobig.F infected machines may be using UDP port 123 [NTP] to check the time once per hour from one of the time servers below: 200.68.60.246 62.119.40.98 150.254.183.15 132.181.12.13 193.79.237.14 131.188.3.222 131.188.3.220 193.5.216.14 193.67.79.202 133.100.11.8 193.204.114.232 138.96.64.10 chronos.cru.fr 212.242.86.186 128.233.3.101 142.3.100.2 200.19.119.69 137.92.140.80 129.132.2.21 A workstation infected with Sobig.F should contain the following file and registry entries: %windir%\winppr32.exe e.g. c:\winnt\winppr32.exe [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TrayX" = %windir%\winppr32.exe /sinc [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TrayX" = %windir%\winppr32.exe /sinc As new information is discovered about the purpose of this mystery program download, it will be posted at the sites below: http://www.f-secure.com/v-descs/sobig_f.shtml http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html Other sites with information: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBIG.F http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBIG.F &VSect=T http://vil.nai.com/vil/content/v_100561.htm I received this information pretty much only from the F-secure.com mailing list [though it's corroborated by the Symantec web site as well]. -----Original Message----- From: Sirkia, Jaana [mailto:Jaana.Sirkia@F-Secure.com] Sent: Friday, August 22, 2003 8:38 AM To: press-pr@lists.F-Secure.com; press-english-virus-announcement@lists.F-Secure.com; press-english-technical@lists.F-Secure.com Subject: MEDIA RELEASE:A potentially massive Internet attack starts today This press release comes from F-Secure. For more information on F-Secure's mailing list policy, see end of message. PRESS RELEASE August 22, 2003 A potentially massive Internet attack starts today Sobig.F downloads and executes a mysterious program on Friday at 19:00 UTC F-Secure Corporation is warning about a new level of attack to be unleashed by the Sobig.F worm today. Windows e-mail worm Sobig.F, which is currently the most widespread worm in the world, has created massive e-mail outages globally since it was found on Tuesday the 18th of August - four days ago. The worm spreads itself via infected e-mail attachments in e-mails with a spoofed sender address. Total amount of infected e-mails seen in the Internet since this attack started is close to 100 million. However, the Sobig.F worm has a surprise attack in its sleeve. All the infected computers are entering a second phase today, on Friday the 22nd of August, 2003. These computers are using atom clocks to synchronize the activation to start exactly at the same time around the world: at 19:00:00 UTC (12:00 in San Francisco, 20:00 in London, 05:00 on Saturday in Sydney). On this moment, the worm starts to connect to machines found from an encrypted list hidden in the virus body. The list contains the address of 20 computers located in USA, Canada and South Korea. "These 20 machines seem to be typical home PCs, connected to the Internet with always-on DSL connections", says Mikko Hypponen, Director of Anti-Virus Research at F-Secure. "Most likely the party behind Sobig.F has broken into these computers and they are now being misused to be part of this attack". The worm connects to one of these 20 servers and authenticates itself with a secret 8-byte code. The servers respond with a web address. Infected machines download a program from this address - and run it. At this moment it is completely unknown what this mystery program will do. F-Secure has been able to break into this system and crack the encryption, but currently the web address sent by the servers doesn't go anywhere. "The developers of the virus know that we could download the program beforehand, analyse it and come up with countermeasures", says Hypponen. "So apparently their plan is to change the web address to point to the correct address or addresses just seconds before the deadline. By the time we get a copy of the file, the infected computers have already downloaded and run it". Right now, nobody knows what this program does. It could do damage, like deleting files or unleash network attacks. Earlier versions of Sobig have executed similar but simpler routines. With Sobig.E, the worm downloaded a program which removed the virus itself (to hide its tracks), and then started to steal users network and web passwords. After this the worm installed a hidden email proxy, which has been used by various spammers to send their bulk commercial emails through these machines without the owners of the computers knowing anything about it. Sobig.F might do something similar - but we won't know until 19:00 UTC today. "As soon as we were able to crack the encryption used by the worm to hide the list of the 20 machines, we've been trying to close them down", explains Mikko Hypponen. F-Secure has been working with officials, authorities and various CERT organizations to disconnect these machines from the Internet. "Unfortunately, the writers of this virus have been waiting for this move too." These 20 machines are chosen from the networks of different operators, making it quite likely that there won't be enough time to take them all down by 19:00 UTC. Even if just one stays up, it will be enough for the worm. The advanced techniques used by the worm make it quite obvious it's not written by a typical teenage virus writer. The fact that previous Sobig variants we're used by spammers on a large scale adds an element of financial gain. Who's behind all this? "Looks like organized crime to me", comments Mikko Hypponen. F-Secure is monitoring the Sobig.F developments through the night on Friday the 22nd. Updates will be posted to Sobig.F's virus description at http://www.f-secure.com/v-descs/sobig_f.shtml F-Secure Anti-Virus can detect and stop this worm. F-Secure Anti-Virus can be downloaded from http://www.f-secure.com About F-Secure F-Secure Corporation is the leading provider of centrally managed security solutions for the mobile enterprise. The company's award-winning products include antivirus, file encryption and network security solutions for major platforms from desktops to servers and from laptops to handhelds. Founded in 1988, F-Secure has been listed on the Helsinki Exchanges since November 1999. The company is headquartered in Helsinki, Finland, with the North American headquarters in San Jose, California, as well as offices in Germany, Sweden, Japan and the United Kingdom and regional offices in the USA. F-Secure is supported by a network of value added resellers and distributors in over 90 countries around the globe. Through licening and distribution agreements, the company's security applications are available for the products of the leading handheld equipment manufacturers, such as Nokia and HP. Finland: F-Secure Corporation Mikko Hypponen, Director, Anti-Virus Research PL 24 FIN-00181 Helsinki Tel +358 9 2520 5513 Fax. +358 9 2520 5001 Email Mikko.Hypponen@F-Secure.com For more information, please contact: Media contact in the USA: F-Secure Inc. Heather Deem, 675 N. First Street, 5th Floor San Jose, CA 95112 Tel +1 408 350 2178 Fax +1 408 938 6701 Email Heather.Deem@F-Secure.com http://www.F-Secure.com/ Mailing list policy You have previously expressed interest in our products, or have asked to be included on one of our press release lists by personally giving us your e-mail address for this purpose. Our mailing list are for the exclusive use and the expressed purpose of F-Secure and are not sold or given to third parties. If you no longer wish to receive our press releases, or your email address has been added to our lists without your consent, you can unsubscribe at http://www.F-Secure.com/news/subscribe.html If you only wish to receive our press releases concerning viruses, please go to http://www.F-Secure.com/news/subscribe.html and first unsubscribe from press-english-interest@lists.F-Secure.com and then subscribe to press-english-virus-announcement@lists.F-Secure.com ***************************************** Jaana Sirkiä, Communications Manager F-Secure Corporation PL 24 FIN 00181-Helsinki Tel. +358 9 2520 5290 Fax +358 9 2520 5018 Mobile +358 400 303096 http://www.F-Secure.com ******************************************* Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29927
  - 22
    - ** READ THIS BEFORE POSTING - answers to frequently asked questions 2003.08.22 Before you post a question to a Microsoft.public.*.security newsgroup, note that your question may already be answered below: Answers to Top Frequently Asked Questions: http://securityadmin.info My question is not mentioned below. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.htm#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.htm#netiquette I have the RPC Blaster worm "virus," what do I do? http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. My computer is giving RPC Remote Procedure Call messages. There is a TFTP message or file on my computer. My computer keeps locking up, and/or rebooting, or telling me that it will reboot in 1 minute. http://www.microsoft.com/security/incident/blast.asp ALSO NOTE: www.grisoft.com is free antivirus, USE IT. Where can I download the Blaster worm / RPC DCOM patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I just heard about a new Microsoft security patch update. Where can I get the patch? http://windowsupdate.microsoft.com OR http://www.microsoft.com/technet/security/current.asp I just installed a Microsoft security patch update, and now my computer is having problems. http://securityadmin.info/faq.htm#patchbroke I received an email from Microsoft / Microsoft Support / Microsoft Internet Security Center claiming to be a security patch [or comprehensive Internet Explorer update]. Is this a virus? http://securityadmin.info/faq.htm#microsoftemail ALSO NOTE: www.grisoft.com is free antivirus, USE IT. I received a virus email from a Microsoft email address. Who do I report this to? http://securityadmin.info/faq.htm#microsoftemail I'm having a problem caused by the JDBGMGR.EXE Teddy Bear "virus" hoax, or I want to replace this file. http://securityadmin.info/faq.htm#jdbgmgr I forgot my Windows logon password and can't log in. How do I reset it? http://securityadmin.info/faq.htm#password I have a problem or a question with a virus or with antivirus. http://securityadmin.info/faq.htm#virus NOTE: www.grisoft.com is free antivirus, USE IT. Why is Outlook Express blocking my attachments as "unsafe"? http://securityadmin.info/faq.htm#attachments How do I stop getting pop-up messages? Or adware? Or spyware? http://securityadmin.info/faq.htm#pop-ups How do I block people from viewing adult or objectionable content on a computer? http://securityadmin.info/faq.htm#contentfilter How do I block spam emails? http://securityadmin.info/faq.htm#spam There is a Content Advisor password blocking me from certain web sites. http://securityadmin.info/faq.htm#contentadvisor How do I delete an FTP folder that a hacker put on my computer and I cannot delete? http://securityadmin.info/faq.htm#ftpfolder Have I been hacked? What do I do if I've been hacked? http://securityadmin.info/faq.htm#hacked How do I re-secure a computer that has been hacked? http://securityadmin.info/faq.htm#re-secure How do I test or improve the security on my computer to avoid being hacked? http://securityadmin.info/faq.htm#harden How do I investigate a suspicious IP address that may be trying to hack me? http://securityadmin.info/faq.htm#trace How do I report a hacker? http://securityadmin.info/faq.htm#reporthacker How do I use a port scanner or vulnerability scanner to test my security? http://securityadmin.info/faq.htm#portscanner How do I encrypt my files and/or hard drive? http://securityadmin.info/faq.htm#encryption How do I get a firewall? IDS? http://securityadmin.info/faq.htm#firewall I want to use the IPSec filtering or IP filtering feature of Windows to block certain ports and have a problem or question. http://securityadmin.info/faq.htm#ipsec I have a problem or question with the XP ICF firewall. http://securityadmin.info/faq.htm#icf I have a problem or question with the IIS URLScan tool. http://securityadmin.info/faq.htm#urlscan How do I change the banner on my computer or server to hide what software version I'm using? http://securityadmin.info/faq.htm#banner How do I enable Windows Auditing to tell who logged into Windows or who accessed a file? http://securityadmin.info/faq.htm#auditing How do I inspect and disable programs that start up when Windows starts? http://securityadmin.info/faq.htm#startup How do I use RUNAS or let someone use RUNAS to run commands as administrator without having to type the password? http://securityadmin.info/faq.htm#runas How do I let non-administrator users run Defrag or change their IP address? http://securityadmin.info/faq.htm#runas My question is not mentioned above. How do I get an answer immediately, with no waiting? http://securityadmin.info/faq.htm#moreinfo See also: http://www.google.com/groups?as_ugroup=microsoft.public.* See also: http://www.google.com/advanced_group_search See also: http://www.google.com I want to post a problem or question to the newsgroup. What info do I need to post in order to get a correct answer quickly? http://securityadmin.info/faq.htm#netiquette Note that this is NOT a full list of all the questions answered in the FAQ. Chances are, your question has probably already been answered. The complete FAQ is at: http://securityadmin.info/faq.htm#contents I hope this is helpful. Feedback, suggestions and criticism regarding the FAQ are welcome and may be emailed to me. kind regards, Karl Levinson, CISSP, MCSE, MVP email: levinson_k@despammed.com Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29926
  - 23
    - How to tell if a given TCP/IP port is open or closed? How can I determine whether any given port is open or closed? Many thanks, Robert Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29921
  - 24
    - having issue trying to run msn chat i try to enter a chat room through msn chat and i get this error when trying to download chat do you want to install and run http://fdl.msn.com/public/chat/msnchat45.cab"? the publisher cannot be determined due to the problems below authenticode signature not found yes no more info I click on yes and the room loads up with nothing and a red x in the corner I went in and changed security settings through tools in IE and still same response can anyone help Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29912
  - 25
    - Microsoft Critical Updates Help! I have been continuously getting pop ups from Microsoft asking if I want to accept the Security Update 1 from November 29, 1999. I have already accepted it several times now, but it keeps coming up every 48 hours. I have windows 98. How do I tell Microsoft to stop sending me updates? I have called them and emailed them and have not been able to get an answer. Does anyone know what I should do? Thanks. Tag: ISA Server: Spoof attack from 127.0.0.1? Tag: 29910

Recently I received lots of warnings from ISA Server
saying there is spoof attack from 127.0.0.1. What does
that mean?

ISA Server: Spoof attack from 127.0.0.1? by sgopus

sgopus
Sun Aug 24 22:10:38 CDT 2003

Follow this link and read all about it:

http://packetstormsecurity.nl/advisories/nai/SNI-
12.BIND.advisory

>-----Original Message-----
>Recently I received lots of warnings from ISA Server
>saying there is spoof attack from 127.0.0.1. What does
>that mean?
>.
>

Re: ISA Server: Spoof attack from 127.0.0.1? by svaardt

svaardt
Tue Aug 26 03:54:35 CDT 2003

Not sure about the authenticity of sgopus's (fredd@hotmail.com)'s site...
probably advise steering clear of this one.

"sgopus" <fredd@hotmail.com> wrote in message
news:006d01c36ab6$75826da0$a001280a@phx.gbl...
> Follow this link and read all about it:
>
> http://packetstormsecurity.nl/advisories/nai/SNI-
> 12.BIND.advisory
>
>
>
> >-----Original Message-----
> >Recently I received lots of warnings from ISA Server
> >saying there is spoof attack from 127.0.0.1. What does
> >that mean?
> >.
> >

Re: ISA Server: Spoof attack from 127.0.0.1? by Bill

Bill
Tue Aug 26 19:18:13 CDT 2003

umm..

It's a PGP signed text page--don't think there's anything sinister about it:

http://packetstormsecurity.nl/advisories/nai/SNI-12.BIND.advisory

"svaardt" <svaardt@h0tmail. com> wrote in message
news:O6$AT%236aDHA.2072@TK2MSFTNGP10.phx.gbl...
> Not sure about the authenticity of sgopus's (fredd@hotmail.com)'s site...
> probably advise steering clear of this one.
>
>
>
> "sgopus" <fredd@hotmail.com> wrote in message
> news:006d01c36ab6$75826da0$a001280a@phx.gbl...
> > Follow this link and read all about it:
> >
> > http://packetstormsecurity.nl/advisories/nai/SNI-
> > 12.BIND.advisory
> >
> >
> >
> > >-----Original Message-----
> > >Recently I received lots of warnings from ISA Server
> > >saying there is spoof attack from 127.0.0.1. What does
> > >that mean?
> > >.
> > >
>
>