question<br>where yhou have your firewall/gateway is a linux box?<br><br>if it is, install NTOP<br>help to install<br><a href="http://www.howtoforge.com/network_monitoring_with_ntop">http://www.howtoforge.com/network_monitoring_with_ntop</a><br>
<br>on the port list in use, click on TCP 135/139/445/593, and the computer with most activity will be the bad one,<br><br>add into the firewall a line and denial those port, if your are using iptables, or whatever you&#39;re using just close those port in and out.<br>
<br>ntop is a small program, but effective, it wont cure the problem but you will know where to go.<br><br>nagios is another good tool, with more capabilities, <br> now from those 150 puters, how many are windows.do you have antivirus for all of them.<br>
walter<br><br><br><div class="gmail_quote">On Thu, May 20, 2010 at 1:28 AM, Technomage <span dir="ltr">&lt;<a href="mailto:technomage.hawke@gmail.com">technomage.hawke@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im">On 5/19/10 5:44 PM, <a href="mailto:kitepilot@kitepilot.com" target="_blank">kitepilot@kitepilot.com</a> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Hello World:<br>
Long story short:<br>
I got an &quot;official&quot; notification that a computer behind my Linux firewall has the &quot;Win32.Worm.Allaple.Gen&quot; virus.<br>
I have some 150 puters NAT(ed) behind that firewall and no access whatsoever to any of them.<br>
Question is:<br>
What can I do at the Firewall level to identify the virus&#39; traffic so I can harvest the puter&#39;s IP address...<br>
Thanks!<br>
ET<br>
</blockquote></div>
from <a href="http://www.threatexpert.com/report.aspx?md5=732f8e67310a1de1c945948bda2512eb" target="_blank">http://www.threatexpert.com/report.aspx?md5=732f8e67310a1de1c945948bda2512eb</a><br>
***********<br>
Summary of the findings:<br>
What&#39;s been found:<br>
A network-aware worm that uses known exploit(s) in order to replicate across vulnerable networks.<br>
MS04-012: DCOM RPC Overflow exploit - replication across TCP 135/139/445/593 (common for Blaster, Welchia, Spybot, Randex, other IRC Bots).<br>
Contains characteristics of an identified security risk.<br>
***********<div><div></div><div class="h5"><br>
---------------------------------------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.plug.phoenix.az.us" target="_blank">PLUG-discuss@lists.plug.phoenix.az.us</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss" target="_blank">http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss</a><br>
</div></div></blockquote></div><br>