Norton Internet Security and my website

[printerbase]

Hi,

I hope somebody can help me this it is driving me nuts.

For some reason all the computers in the office running Norton Internet Security are reporting an intrusion attempt whenever we access our website which is www.printerbase.co.uk but it is only our website it happens with.

This results in the site becoming very slow and unresponsive on the local PC, the intrusion listed by Norton is:
Attempted Intrusion "HTTP IIS ISAPI Printer BO" from your machine against www.printerbase.co.uk(217.72.180.90) was detected and blocked
Intruder: localhost(2687)
Risk Level: Medium
Protocol: TCP
Attacked IP: www.printerbase.co.uk(217.72.180.90)
Attacked Port: http(80)

We've scanned for viruses and spyware, tried IE and FireFox but still no joy, it has only started happening today and we haven't installed or done anything to either the PC's or the website.

We are also getting the same reports from some customers running Norton as well.

I would be very grateful if anyone running Norton IS could try our site and let me know if the same happens and hopefully help me shed some light on what is going on.

Peter

 

[Ozzy]

This is only a guess but try investigating down the route of visitor tracking and statistical software that the server/website may be running.

 

sounds like a vulnerability that needs to be patched.
Have a look at this Microsoft Security Bulletin MS01-023.

James

IT Security Solutions Ltd

 

[printerbase]

I had a look at that, but our site is running on a shared Linux server and all our PC's are running XP and fully patched up.

I am waiting to see what our hosting company have to say.

Peter :cry:

 

[printerbase]

Norton updated it's Intrusion Detection signatures this morning and the problem has been sorted.
Looking at the log in Norton they appear to have downgraded their signatures.
The old version was:
2.0.0.50113 monitoring 439 signatures
The new version is:
1.9.1 monitoring 242 signatures
I don't know what version was running before the problem occurred but it looks like they had a problem with their signatures.
Still seems very strange it only seemed to effect our site.

Having a problem like this also shows you what sort of support you can get from your webhosts and people like Symantec and the answer is not a lot at all !

Peter

 

[RockLinks]

I tell my clients to stay well away from Norton it always causes problems. I recommend panda.

 

[BMS]

Hi Peter

Another option is McAfee Security centre, seems to work fine and had no problems with it.

Even picked up trojan horse viruses from somewhere and it dealt with them also allows you to trace any intrusions to their source.

 

[Rob Holmes]

I tell my clients to stay well away from Norton it always causes problems. I recommend panda.

I've always found Panda to be exceptionally slow on startup.

I personally use Zonealarm Security Suite ( www.zonelabs.com )

I set clients up with AVG for Antivirus and Zonealarm Free Firewall too.

Rob

 

[RockLinks]

I have never had a problem with it and my clients have never complained. The biggest problem is there are so many to choose from now.