[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ISSForum] MSRPC - events

To: issforum@xxxxxxx
Subject: [ISSForum] MSRPC - events
From: "Witkowski,Tytus,WARSAW,GLOBE IT-CC" <Tytus.Witkowski@xxxxxxxxxxxxx>
Date: Thu, 9 Oct 2003 10:14:51 +0200
Delivery-date: Thu, 09 Oct 2003 15:43:54 +0200
Envelope-to: iss@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
List-archive: <https://atla-mm1.iss.net/mailman/private/issforum/>
List-help: <mailto:issforum-request@iss.net?subject=help>
List-id: ISS Forum <issforum.iss.net>
List-post: <mailto:issforum@iss.net>
List-subscribe: <https://atla-mm1.iss.net/mailman/listinfo/issforum>, <mailto:issforum-request@iss.net?subject=subscribe>
List-unsubscribe: <https://atla-mm1.iss.net/mailman/listinfo/issforum>, <mailto:issforum-request@iss.net?subject=unsubscribe>
Sender: issforum-admin@xxxxxxx

Hi All
On our one network sensor (7.0) inside windows network I receive a lot of
events with description MSRPC_RemoteActivate_Bo. Is it connected to
MSOutlook client which start communication with Exchange server (port 135)
or is it some kind of MSRPC vulnerability (unpatched PC, infected PC)???

br
Tytus Witkowski
_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo

Prev by Date: Re: [ISSForum] Scans from SP 2.0 Console and Internet scanner
Next by Date: RE: [ISSForum] Two EventCollector Installed In One Machine
Previous by thread: [ISSForum] Keys issue
Next by thread: [ISSForum] MSRPC - events
Index(es):
- Date
- Thread