Re: Sasser connects to AS/400

["Adam Lang" <aalang@xxxxxxxxxxxxxxxxxxxx>]

I would assume there are infected PCs in his internal lan.

Also, it isn't connecting to the "AS/400" perse.  It is connecting to
Windows shares, which Netserver emulates.

----- Original Message ----- 
From: "Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, May 04, 2004 11:04 AM
Subject: RE: Sasser connects to AS/400


> >this IP address is not publicly known.
>
> Oliver, is it accessible from the 'net? If so the IP is publicly known.
> Many (most?) worms simply scan IPs, they are in predictable format after
> all. They may not know that the IP belongs to you, but they know it's an
> IP address.
>
> Also, what do you mean by "remote pc's (other WAN locations)" do you
> mean remote locations that are still inside your corporate network, or
> are you talking about Internet locations? If the latter (and maybe even
> if the former) why are you even allowing 445 through the firewall?
>
> -Walden
>
> ------------
> Walden H Leverich III
> President & CEO
> Tech Software
> (516) 627-3800 x11
> WaldenL@xxxxxxxxxxxxxxx
> http://www.TechSoftInc.com
>
> Quiquid latine dictum sit altum viditur.
> (Whatever is said in Latin seems profound.)
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.