OT: MS Tried to Hack My Computer???

[Atrocities]

The proof is in the trace. They have been hitting me constantly for over an hour now. Right our of Seatle. Does any one wanna take a crack as to why?

[Suicide Junkie]

Hitting you with what, exactly?

Odds are its a virus of some sort...

[Atrocities]

The firewall detected it as a hostle inbound event and such. I am running spyware and anti virus software now to check my system, but when I ran a trace on the event, it clearly showed it coming out of seattle right into portland. Very odd. This is why I posted it.

[Suicide Junkie]

I mean, like what port, how often, size per packet, or whatever else you know.

[Thermodyne]

Need the port and proto that got bounced to say for sure. But it looks like you are blocking mail or IM traffic. Also MS is often the target of spoofing by script kiddies.

[Baron Munchausen]

You are assuming the Microsoft can keep control of its own machines!? What other OS would they be using except Wind'ohs?

(Ok, I have heard that they do run Free BSD on a lot of Hotmail servers.)

I think it's just as likely that a Microsoft server on MS' very own campus could be hijacked as a server anywhere else. It's also possible that someone could be spoofing packets from a completely different domain than Microsoft.

[Katchoo]

Atrocities, can you post a sample of your firewall log here, or upload it to NASY with a link to it here for us to look at it? If we can see everything that your Firewall is reporting, then we might be able to nail down what's happening.

[rdouglass]

Probably the lates Bagle variant. That's a busy one lately. What you're posting here tho looks like a reverse IP lookup.

Do you know what port(s) you're being attacked on? IMO that'll tell you a lot more than the "apparent" IP address. That's pretty easily spoofed nowadays. However, the ports and other items are a better fingerprint IMO.

[Sivran]

More likely it's an MSN user infected with a worm or two, or three. No need to worry, or blame MS. :P Blame the idiot Users who directly connect their NT-based machines to the internet.

[Baron Munchausen]

Directly connect them and don't properly configure them, you mean....

You have to set your machine up with the right permissions and restrictions or you get 0wned within minutes of going Online. Most people get their broadband and connect with NETBIOS active -- which is designed for LANs, not the Internet! A properly configured system is dramatically harder to infect, especially with third party enhancements like firewalls and anti-virus software.

I've just recently installed a firewall even though I'm on dialup and I get probes to port 445 (NETBIOS) every few minutes even though I'm on a rotating dialup connection! Since I was smart enough to disable my NETBIOS before I went Online this is not a problem for me. But if even dialup lines are under constant probes, imagine how bad it must be on DSL address blocks where the hackers and worms know you have a high-speed line.