Intrusion attempt from Entmoot reported by Norton Internet Security

***Alcuin*** · 07-03-2006, 02:17 AM

At 01:34:03 Eastern Time (US), 3 July 2006, my Norton Internet Security reported:

Quote:

Details: Attempted Intrusion "ICC Profile TagData Overflow" against your machine was detected and blocked
Intruder: entmoot.tolkientrail.com(204.11.53.191)(http(80))
Risk Level: High
Protocol: TCP
Attacked IP: localhost.
Attacked Port: 3212

Symantec describes the problem here: http://www.symantec.com/avcenter/att...gs/s21196.html.
Norton then shut off Entmoot for 30 minutes.

Microsoft describes the attack in “MS05-036: Vulnerability in Microsoft Color Management Module could allow remote code execution,” http://support.microsoft.com/?kbid=901214.

Anyone have any insight here?

***Valandil*** · 07-03-2006, 08:55 AM

This is out of my league, but I've waved a flag in the mod forum - so hopefully one of our more tech-minded admins can follow-up on it.

Thanks for letting us know.

Spock · 07-03-2006, 10:51 AM

It could be a 'ping' which many sites use; not quite a cookie but an identifing tool.

Two yrs. ago I had a heavy duty protection on my computer and I'd get this kind of thing several times a day. It was so annoying I finally wrote to one of the companies reported and got back a very nice and detailed reply explaining what was happening and that no intrusion nor attempt at access was being done but rather just an identification and routing tool.

There, that's my input.

P.S. I have Norton and haven't gotten any similar messages since installing the program.

Curubethion · 07-05-2006, 05:40 PM

Entmoot's trying to hack my computer??

I know you'd never do that to me...would you?

durinsbane2244 · 07-05-2006, 05:49 PM

i would agree with spock. it was probably the "remember me" feature, which is a cookie, if not just cookie-like, because when i once deleted all cookies, i had to re-sign in...

Butterbeer · 07-05-2006, 06:08 PM

sounds remarkably like the 'chocolate-chip' worm ...

07-03-2006, 08:55 AM	#2
*Valandil* High King at Annuminas Administrator Join Date: Oct 2003 Location: Wyoming - USA Posts: 10,752	This is out of my league, but I've waved a flag in the mod forum - so hopefully one of our more tech-minded admins can follow-up on it. Thanks for letting us know. __________________ My Fanfic: Letters of Firiel Tales of Nolduryon Visitors Come to Court Ñ á ë ?* ó ú é ä ï ö Ö ñ É Þ ð ß ® ™ [Xurl=Xhttp://entmoot.tolkientrail.com/showthread.php?s=&postid=ABCXYZ#postABCXYZ]text[/Xurl] Splitting Threads is SUCH Hard Work!!

07-03-2006, 10:51 AM	#3
Spock An enigma in a conundrum Join Date: Oct 1999 Posts: 6,476	It could be a 'ping' which many sites use; not quite a cookie but an identifing tool. Two yrs. ago I had a heavy duty protection on my computer and I'd get this kind of thing several times a day. It was so annoying I finally wrote to one of the companies reported and got back a very nice and detailed reply explaining what was happening and that no intrusion nor attempt at access was being done but rather just an identification and routing tool. There, that's my input. P.S. I have Norton and haven't gotten any similar messages since installing the program. __________________ Vizzini: "HE DIDN'T FALL?! INCONCEIVABLE!!" Inigo: "You keep using that word. I do not think it means what you think it means."

07-05-2006, 05:40 PM	#4
Curubethion Fenway Ranger, Lord of Red Sox Nation Join Date: Aug 2005 Location: College! Posts: 1,976	Entmoot's trying to hack my computer?? I know you'd never do that to me...would you? __________________ Adventure...betrayal...heroism... Atharon: where heroes are born. My wife once said to me—when I'd been writing for ten or fifteen years—that I could always go back to being a nuclear engineer. And I said to her, 'Harriet, would you let someone who quit his job to go write fantasy anywhere near your nuclear reactor? I wouldn't!' (Robert Jordan)

07-05-2006, 05:49 PM	#5
durinsbane2244 Dreamweaver Join Date: Apr 2005 Location: The Misty Mountains, where the spirits go... Posts: 3,560	i would agree with spock. it was probably the "remember me" feature, which is a cookie, if not just cookie-like, because when i once deleted all cookies, i had to re-sign in... __________________ Lord, what fools these mortals be! ---------------- We are the music-makers, And we are the dreamers of dreams, Wandering by lone sea-breakers, And sitting by desolate streams; World-losers and world-forsakers, On whom the pale moon gleams: Yet we are the movers and shakers Of the world for ever, it seems. ---------------- Shanti, shanti, shantih...

07-05-2006, 06:08 PM	#6
Butterbeer Elf Lord Join Date: Mar 2005 Location: here and there Posts: 3,514	sounds remarkably like the 'chocolate-chip' worm ...