Using ZAP firewall (135->127 blocked) and AVGP antivirus, all MS Updates
applied. OS is registered Win98 1st. Also have AdAware & Spybot. None of
these are indicating any security issues. However, my domain is having LOTS
of static IP's scanned (ICMP ping) every few seconds - pings are blocked on
all machines). I've previously implemented "UnPlug n' Pray" to turn off MS
UPnP, too.
Recently on one machine I had font for a few 3rd party pgms (old installs,
until now been displaying fine for years) start showing blank square boxes
instead of readable text (such as with the Spell Checker named WordWeb
1.51). Restoring backup of Fonts folder content and Registry didn't cure, so
used File Monitor (http://www.sysinternals.com) to watch WordWeb and saw it
try to use a font named MANGAL.TTF (probably installed from MS Update to
support other languages in IE). Used Fonts Folder utility to delete it.
Rebooted, no cure & no trace by File Monitor of what font it was trying to
load for a replacement. But while monitoring with File Monitor this entry
occurred:
6:51:18 AM Rpcss Read C:\BATCH\MOUSEMGR.DLL SUCCESS Offset: 20770816 Length:
4096
Interesting thing is I do have that BATCH folder (I created it years ago)
but no such filename exists there or anywhere on any drive (does now, since
I put a attrib +S+H+R dummy text file of that name in BATCH folder). But how
could File Monitor have had a read success before I created that dummy
filename??? I am seriously suspecting a security breach, but no luck in
pinning it down. Anyone have some comments, ideas, etc.?
Mostly Anonymous