Bernard, > I am seeing the Remote_Storm service in my firewall log. What is it? TCP Port 1025 is also used by exploits looking for Windows vulnerabilities in msdtc and dcom. You might want to look at http://www.milw0rm.com/id.php?id=76 and at http://www.f-secure.com/v-descs/dasher_b.shtml for a description of a few possibilities.
I'd consider it to be normal noise you'll see on your firewalls these days. Unless you operate windows systems unpatched for two years on public IP space, that is. Cheers, Joerg -- Joerg Weber M. A. Chief Security Officer infoServe GmbH Am Felsbrunnen 15 66119 Saarbrücken - Güdingen T: (0681) 8 80 08 - 59 F: (0681) 8 80 08 - 33 www.infos.de mailto: [EMAIL PROTECTED] Handelsregister: Amtsgericht Saarbrücken, HRB 11001 Erfüllungsort: Saarbrücken Geschäftsführer: Dr. Werner Stein Ust-IdNr.: DE168970599 > -----Ursprüngliche Nachricht----- > Von: Mailing list for discussion of Firewall-1 [mailto:FW-1- > [EMAIL PROTECTED] Im Auftrag von Bernard Jen > Gesendet: Montag, 31. März 2008 16:37 > An: [email protected] > Betreff: [FW-1] Remote_Storm > > I am seeing the Remote_Storm service in my firewall log. What is it? > > Thanks. > > > > Scanned by Check Point Total Security Gateway. > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
