FirewallWizards
[Top] [All Lists]

Re: [fw-wiz] worm?

To: "Firewall Wizards Security Mailing List" <firewall-wizards@listserv.icsalabs.com>
Subject: Re: [fw-wiz] worm?
From: "Brian Loe" <knobdy@gmail.com>
Date: Thu, 1 Feb 2007 16:34:24 -0600
Delivered-to: sp-com-lists@consult.net
Delivered-to: fwwizards-list2@consult.net
Delivered-to: firewall-wizards@listserv.icsalabs.com
In-reply-to: <003001c7464c$da107940$3400300a@ad.priorityhealth.com>
List-archive: <https://listserv.icsalabs.com/pipermail/firewall-wizards>
List-help: <mailto:firewall-wizards-request@listserv.icsalabs.com?subject=help>
List-id: Firewall Wizards Security Mailing List <firewall-wizards.listserv.icsalabs.com>
List-post: <mailto:firewall-wizards@listserv.icsalabs.com>
List-subscribe: <https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards>, <mailto:firewall-wizards-request@listserv.icsalabs.com?subject=subscribe>
List-unsubscribe: <https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards>, <mailto:firewall-wizards-request@listserv.icsalabs.com?subject=unsubscribe>
References: <3c4611bc0702011045q66c03488wf608861119ecbd2d@mail.gmail.com> <003001c7464c$da107940$3400300a@ad.priorityhealth.com>
Reply-to: Firewall Wizards Security Mailing List <firewall-wizards@listserv.icsalabs.com>
Sender: firewall-wizards-bounces@listserv.icsalabs.com
On 2/1/07, Paul Melson <pmelson@gmail.com> wrote:
>
> I think your technician needs to try booting from trusted media and using
> more than one type of scanner.  The only time we've ever had outbound SMTP
> sweeps from a Windows workstation it was botted.
>
> PaulM

This will serve as a response to everyone who responded - some
excellent suggestions that I will certainly have him follow-up on, as
best as my position allows. :)

Fortunately we have managed to configure enough security that we
disallow outgoing connections to port 25.

Thanks!
_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

<Prev in Thread] Current Thread [Next in Thread>