RE: [ISSForum] MSRPC - events

["Dardet, Eduardo" <Eduardo.Dardet@xxxxxxxxxxxx>]

It is the Blaster or Welchia worm.

-----Original Message-----
From: issforum-admin@xxxxxxx [mailto:issforum-admin@xxxxxxx] On Behalf
Of Witkowski,Tytus,WARSAW,GLOBE IT-CC
Sent: Thursday, October 09, 2003 4:15 AM
To: issforum@xxxxxxx
Subject: [ISSForum] MSRPC - events

Hi All
On our one network sensor (7.0) inside windows network I receive a lot
of
events with description MSRPC_RemoteActivate_Bo. Is it connected to
MSOutlook client which start communication with Exchange server (port
135)
or is it some kind of MSRPC vulnerability (unpatched PC, infected PC)???

br
Tytus Witkowski
_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo

--------------------------------------------------
This e-mail transmission contains information intended only for the use of the recipient(s) named above. Further, it contains information that may be privileged and confidential.  If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this message (including any attachments) is strictly prohibited.  If you have received this e-mail in error, please notify the sender by reply e-mail and then delete this message from your mail system. Thank you for your compliance.


_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo