Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying out Microsoft Security Essentials on a test computer. I set it to run a full scan last night at 2am, and this morning I noticed a lot of 403s in my Apache error.log coming from that systems IP.

Wed Feb 17 03:00:22 2010] [error] [client 192.168.1.168] 
  Digest: user `' in realm Restricted' not found: /

With corresponding events in access.log

192.168.1.168 - "" [17/Feb/2010:03:00:22 -0500] 
  "OPTIONS / HTTP/1.1" 401 465 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"

So I ran through the rest of the logs and found even more connection attempts in every Samba server I have:

[2010/02/17 03:00:21, 0] smbd/service.c:make_connection(1200)
  fluency (192.168.1.168) couldn't find service public.exe
[2010/02/17 03:00:22, 0] param/loadparm.c:process_usershare_file(4611)
  process_usershare_file: stat of /var/lib/samba/usershares/public.ex failed. Permission denied
[2010/02/17 03:00:22, 0] param/loadparm.c:process_usershare_file(4611)
  process_usershare_file: stat of /var/lib/samba/usershares/public.ex failed. No such file or directory
[2010/02/17 03:00:22, 0] smbd/service.c:make_connection(1200)
  fluency (192.168.1.168) couldn't find service public.ex
[2010/02/17 03:00:22, 0] param/loadparm.c:process_usershare_file(4611)
  process_usershare_file: stat of /var/lib/samba/usershares/public.com failed. Permission denied
[2010/02/17 03:00:22, 0] param/loadparm.c:process_usershare_file(4611)
  process_usershare_file: stat of /var/lib/samba/usershares/public.com failed. No such file or directory
[2010/02/17 03:00:22, 0] smbd/service.c:make_connection(1200)
  fluency (192.168.1.168) couldn't find service public.com

I wasn't able to find a way to disable network scanning in Security Essentials, and it doesn't seem to be doing any damage (just knocking on every door it can see). Should I worry about this? Does anyone know a way to stop this activity (other then switching back to Quick Scan)? Thanks

share|improve this question
    
Depending on the policy at your company, just "testing" vulnerability software may be considered an attack. Assuming you are authorized to do what you are doing you may want to isolate the test machine from the network until you verify it is performing only the scans you intend. This will prevent "issues" with your security team. ;-) –  Chris Nava Feb 18 '10 at 23:10
    
Good Point! It is in a separate network from production machines. –  charlesbridge Feb 19 '10 at 16:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.