Forum Moderators: open

Message Too Old, No Replies

Access requests spoofing Symantec

Symantec domain unavailable

         

HarryM

1:44 pm on May 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I am getting attempts to access my PC every few seconds (several while typing this). I block them, but they launch an alert which spoofs Symantec urging me to click on a URL. I don't of course, but I'm sure many will.

I have tried to get to Symantec main site to see if there is any info about this, but I get Gateway timeouts.

Is anyone else seeing this?

[edited] I notice that this does not show up in 'recent posts'. Should I repost in a different forum? [/edited]

HarryM

1:56 pm on May 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Post now in 'recent posts'. I didn't realize there would be a delay.

jdMorgan

2:41 pm on May 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



[symantec.com...] works for me.

I'd suggest you run AdAware, SpyBot Search & Destroy, and Hijack This -- You've probably caught something nasty.

Jim

HarryM

2:55 pm on May 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Thanks Jim,

But I don't think it's internal. I can now get into Symantec, so presumably the Gateway timeouts were just a temporary thing. Also the attacks are inbounds which are intercepted by Norton Internet Security.

Protocol: TCP (Inbound)
Remote Address: 217.134.122.64 : 2705
Local Address: 217.134.122.201 : 2745

After blocking them I get an alert-style window pertaining to come from Symantec. The message is "Norton Internet Security Error - you have more Program Control Rules than Norton Internet Security can support", and it urges me to click on a URL, which naturally I don't.

The last two number of the Remote Address change frequently so it is impossible to set up a rule.

I have emailed spamwatch at Symantec and also the ISP for the address.

But I will take your advice and check out my system for nasties. Never know what I might find. :)

bcolflesh

3:00 pm on May 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Akamai was hosed last night/this morning - should be fixed now:

[slashdot.org...]

lawman

6:15 pm on May 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



>>Post now in 'recent posts'. I didn't realize there would be a delay.

The default for all Foo posts is "inactive". A mod or admin must have made this thread active for it to show up in recent posts.