[mjkkid]

alright im having a very big problem here... i try to go to an msn group and upload pictures there but when i do the screen goes white and says page could not be found.. no other site does this.. after i close the window my norton internet security says someone is attempting to attack my computer.. this is what i get when i check the alert.. the following ip adress is attempting to intrude: 65.54.134.126 and the attacker is http netscape cookie monster attack.. i also figured out where it is coming from.. the ip adress if from microsoft in reding washington i checked for logs of these attacks and here is what i got..

Details: groups.msn.com(65.54.134.126) will be blocked further access to your machine for 30 minutes.
Click on the address to trace the attacker

Details: Attempted Intrusion "HTTP Netscape Cookie Monster" against your machine was detected and blocked
Intruder: groups.msn.com(65.54.134.126)(http(80))
Risk Level: Medium
Protocol: TCP
Attacked IP: localhost.
Attacked Port: 1194

Click on the address to trace the attacker

Details: Attempted Intrusion "HTTP Netscape Cookie Monster" against your machine was detected and blocked
Intruder: groups.msn.com(65.54.134.158)(http(80))
Risk Level: Medium
Protocol: TCP
Attacked IP: 0.0.0.0.
Attacked Port: 4390

Click on the address to trace the attacker

its starting to become a hassle because i need to get to that site.. can someone please help?

Edited by mjkkid, 22 June 2005 - 07:59 AM.

[Advertisements]

well i figured out it was redmound not reding.. the ip adress is microsoft but its from http://groups.msn.com please im begging someone to help me im desperate and ive tried pretty much everything i could.. ive never faced a cookie monster attack and i don't know how to get rid of it the funny thing is that its an http netscape cookie monster attack and i don't even have netscape please help.. do i need to make a hijack this log .. or and adawre se log?

[mjkkid]

well i figured out it was redmound not reding.. the ip adress is microsoft but its from http://groups.msn.com please im begging someone to help me im desperate and ive tried pretty much everything i could.. ive never faced a cookie monster attack and i don't know how to get rid of it the funny thing is that its an http netscape cookie monster attack and i don't even have netscape please help.. do i need to make a hijack this log .. or and adawre se log?

[Metallica]

I found this:
http://securityrespo...ids/s20506.html

This signature detects an attempt to access the locally stored cookies on the victim system.

Affected:

Netscape Navigator 3.0.4
Netscape Navigator 4.0.6
Netscape Navigator 4.0.7

*admin thinks you should be using a newer version then one of the above, in which case there's nothing to worry about.

Regards,

[mjkkid]

i dont even use netscape.. thats the problem i dont like it and i never downloaded any of those.. and last night i tried to download netscape 8.0 but when i went back to msn groups and tried to add an image i was attacked again i use internet explorer or msn nothing else...

[mjkkid]

here are some details about the ip that is blocking me :

OrgID: MSFT
CustName: Microsoft Corp
Street: One Microsoft Way
City: Redmond
StateProv: WA
Country: US
PostalCode: 98052
RegDate: 1998-07-10
Updated: 2004-08-05
OrgAbuseHandle: ABUSE231-ARIN
OrgAbuseHandle: HOTMA-ARIN
OrgAbuseHandle: MSNAB-ARIN
OrgAdminHandle: MSFTP-ARIN
OrgNOCHandle: ZM23-ARIN
OrgTechHandle: MSFTP-ARIN


NetHandle: NET-65-52-0-0-1
OrgID: MSFT
Parent: NET-65-0-0-0-0
NetName: MICROSOFT-1BLK
NetRange: 65.52.0.0 - 65.55.255.255
NetType: assignment
RegDate: 2001-02-14
Updated: 2004-12-09
NameServer: NS1.MSFT.NET
NameServer: NS5.MSFT.NET
NameServer: NS2.MSFT.NET
NameServer: NS3.MSFT.NET
NameServer: NS4.MSFT.NET
TechHandle: ZM23-ARIN


TechHandle: ZM23-ARIN
TechName: Microsoft Corporation
TechPhone: +1-425-882-8080
TechEmail: [email protected]


OrgAbuseHandle: ABUSE231-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-425-882-8080
OrgAbuseEmail: [email protected]


OrgTechHandle: MSFTP-ARIN
OrgTechName: MSFT-POC
OrgTechPhone: +1-425-882-8080
OrgTechEmail: [email protected]


OrgAdminHandle: MSFTP-ARIN
OrgAdminName: MSFT-POC
OrgAdminPhone: +1-425-882-8080
OrgAdminEmail: [email protected]


OrgNOCHandle: ZM23-ARIN
OrgNOCName: Microsoft Corporation
OrgNOCPhone: +1-425-882-8080
OrgNOCEmail: [email protected]

should i contact them by using one of the e-mails and ask them what is going on?

[Metallica]

They should know about it:
http://groups.msn.co...521989796947028

Regards,