3 replies
by kent.manley
Your description isn't very complete, but here's a place you can start.
Run netstat in a command prompt (netstat -an) to see the foreign addresses, and even better, the ports they are attempting to use. If you see port 80 or http, they are looking for a web server, probably for a cgi-bin directory with buffer overflow problems in its contents. If you see a port 135, 137, or 139, they are looking for open Windows shares. If you have File and Printer Sharing turned on, you are vulnerable tothis kind of attack (there are tons of internet worms out there - hybris, qaz, etc.) - right now.
You really need to be aware of what services they are trying to get to, and understand what your server is running in order to evaluate the risks you face.
Hope this helps.
by aomar
by aomar
This discussion is closed to new replies.
Trending Security posts
Sort by Trending