You're not keeping your log files? Half the point of having a firewall is that it logs all the traffic so you can later review what has happened during some given time frame......
Conficker is not as easy to detect as other viruses as much of the traffic it generates is legal traffic. The virus also is idle if the machine is. Bitdefender is however a free tool that is able to detect and remove the virus quite quickly compared to full AV-solutions where a full scan takes ages. Lars -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[email protected]] On Behalf Of No Name Available Sent: 24. april 2009 01:28 To: [email protected] Subject: Re: [FW-1] Issues with Conficker/DownadUp Virus Thank you for your response. Sorry I should have mentioned there is a delay in receiving these messages and by the time we do we no longer have the log files for the time in the notices as they have been cleared. Ideally I would like to use whatever they are to detect the botnet activity. I have tried contacting my ISP but have not been successful. Scott Wiebe, IT Specialist, Telvent Outsourcing 200 -10333 Southport Rd. S.W., Calgary, AB, Canada, T2W3X6 Tel: +1 (403)212-2292 Fax: +1 (403) 253-7634 Email: [email protected] Calgary, Alberta, Canada David DeSimone <[email protected]> David DeSimone Enviado por: Mailing list for discussion of Firewall-1 <[email protected]> 04/23/2009 04:47 PM Por favor, responda a Mailing list for discussion of Firewall-1 To: [email protected] cc: Subject: Re: [FW-1] Issues with Conficker/DownadUp Virus No Name Available <[email protected]> wrote: > > Here is a sample of the traffic notices I am receiving from our Internet > service provider. It appears to me that it is using random ports. > > Botnet Traffic detected: (Our Public IP) 2009-04-15 18:28:03 srcport > 19934 mwtype Conficker > Botnet Traffic detected: (Our Public IP) 2009-04-15 18:36:41 srcport > 33623 mwtype Conficker Since they give you the source port, do a search through your looks for an "XlateSPort" match that fits the time frame. -- David DeSimone == Network Admin == [email protected] "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you. Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
