Muskio
29-03-2004, 20:48
Raga ho da poco eseguito un win-update e guarda caso allo stesso istante un port scan da telecom, ma nn è finita qua. Appena ha scaricato tt il necessario è cominciata l'installazione dei pacchetti aggiuntivi e all'improvviso un messaggio dal fw: "sistema e kertnel è cambiato dall'ultima volta...(ecc. ecc.)...consentirgli l'accesso?". Io ho messo no ma si è collegato lo stesso e il fw mi ha evidenziato il seguente attacco (sempre da telecom)...
% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html
inetnum: 82.48.0.0 - 82.63.255.255
netname: IT-TIN-20030807
descr: Telecom Italia Net
descr: Provider Local Registry
country: IT
admin-c: LV357-RIPE
tech-c: ES785-RIPE
status: ALLOCATED PA
notify: cgiadmin@cgi.interbusiness.it
notify: datacomnet@telecomitalia.it
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: TIWS-MNT
mnt-routes: INTERB-MNT
changed: hostmaster@ripe.net 20030807
source: RIPE
route: 82.50.0.0/16
descr: INTERBUSINESS
origin: AS3269
notify: network@cgi.interbusiness.it
mnt-by: TIWS-MNT
mnt-routes: INTERB-MNT
changed: net_ti@telecomitalia.it 20040119
source: RIPE
role: EASYIP STAFF
address: Via Val Cannuta, 250
address: I-00100 Roma
address: Italy
phone: +39 06 36881
fax-no: +39 06 36885661
e-mail: ripe-staff@telecomitalia.it
trouble: Please report spam/abuse notification to
trouble: abuse@telecomitalia.it
admin-c: LV357-RIPE
tech-c: CC297-RIPE
tech-c: VS4572-RIPE
nic-hdl: ES785-RIPE
notify: vincenzo.scoppa@telecomitalia.it
changed: vincenzo.scoppa@telecomitalia.it 20020826
source: RIPE
person: Luigi Vassallo
address: Telecom Italia
address: 00100 Roma
address: Italy
phone: +39-6-3688
fax-no: +39-6-3688
e-mail: ripe-staff@telecomitalia.it
nic-hdl: LV357-RIPE
notify: ripe-staff@telecomitalia.it
changed: ripe-staff@telecomitalia.it 20020419
source: RIPE
mnt-by: TIWS-MNT
Che sarà mai? E soprattutto quel file ke mi ha modificato a ke serve? Il fw mi dice qst: "Application has changed since the last time you opened it, process id: 4
Filename: C:\WINDOWS\System32\ntoskrnl.exe
The change was denied by user.
---- Modules changed: 1 ----
C:\WINDOWS\System32\ntoskrnl.exe"
% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html
inetnum: 82.48.0.0 - 82.63.255.255
netname: IT-TIN-20030807
descr: Telecom Italia Net
descr: Provider Local Registry
country: IT
admin-c: LV357-RIPE
tech-c: ES785-RIPE
status: ALLOCATED PA
notify: cgiadmin@cgi.interbusiness.it
notify: datacomnet@telecomitalia.it
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: TIWS-MNT
mnt-routes: INTERB-MNT
changed: hostmaster@ripe.net 20030807
source: RIPE
route: 82.50.0.0/16
descr: INTERBUSINESS
origin: AS3269
notify: network@cgi.interbusiness.it
mnt-by: TIWS-MNT
mnt-routes: INTERB-MNT
changed: net_ti@telecomitalia.it 20040119
source: RIPE
role: EASYIP STAFF
address: Via Val Cannuta, 250
address: I-00100 Roma
address: Italy
phone: +39 06 36881
fax-no: +39 06 36885661
e-mail: ripe-staff@telecomitalia.it
trouble: Please report spam/abuse notification to
trouble: abuse@telecomitalia.it
admin-c: LV357-RIPE
tech-c: CC297-RIPE
tech-c: VS4572-RIPE
nic-hdl: ES785-RIPE
notify: vincenzo.scoppa@telecomitalia.it
changed: vincenzo.scoppa@telecomitalia.it 20020826
source: RIPE
person: Luigi Vassallo
address: Telecom Italia
address: 00100 Roma
address: Italy
phone: +39-6-3688
fax-no: +39-6-3688
e-mail: ripe-staff@telecomitalia.it
nic-hdl: LV357-RIPE
notify: ripe-staff@telecomitalia.it
changed: ripe-staff@telecomitalia.it 20020419
source: RIPE
mnt-by: TIWS-MNT
Che sarà mai? E soprattutto quel file ke mi ha modificato a ke serve? Il fw mi dice qst: "Application has changed since the last time you opened it, process id: 4
Filename: C:\WINDOWS\System32\ntoskrnl.exe
The change was denied by user.
---- Modules changed: 1 ----
C:\WINDOWS\System32\ntoskrnl.exe"