Posted by Korey Humphreys on 9/13/07 7:40am
Msg #210711

NotRot is trying to attack my computer??? Huh!?!

When I do certain things on NotRot, such as when I try to post a new message, my Norton Antivirus pops up saying something about an attempt was made at attacking my computer (though it was blocked).

What is this about? The Risk Name is HTTP llS%2E DoS

Here is a screen shot of Norton's information:
http://www.ips-notary.com/download/Attempted_Intrusion.bmp

TIA

Reply by Stamper_WI on 9/13/07 8:04am
Msg #210712

Me too!

I am also having trouble replying to the discussions. This reply seems to be working though

Reply by MICarole on 9/13/07 8:15am
Msg #210714

Re: Me too!

Just seeing if my Norton's does it too.

Reply by THAWK/MO on 9/13/07 9:37am
Msg #210720

TEST TEST TEST, I have Norton also, so here goes

Reply by THAWK/MO on 9/13/07 9:39am
Msg #210721

No problem here

Norton is just sitting there being quiet. May have been when NOT ROT was making some upgrades and Norton was picking up on something.

Reply by Joan_OH on 9/13/07 9:58am
Msg #210724

Go to the homepage and email Harry directly. I had the same problem a few weeks ago, but he said he had 3 levels of protection and after looking at my info, thought it was me. Others have posted the same thing. I didn't think it was my computer since my Norton picked it up.

Harry needs to hear from you and what Norton found to investigate further

Joan-OH

Reply by Harry [NR] on 9/13/07 11:29am
Msg #210739

Korey -

Thanks for the link and image. It appears that Norton thinks your computer is attempting to initiate a Denial of Service (DoS) attack against Notary Rotary:

An intrusion attempt by IPS was blocked.
Attacking Computer: IPS (24.54.64.103)

This seemed to be the case with a couple of the other users, as well.

In this instance, I think the reference to "HTTP IIS %2E DoS" is telling us that the URL that was being accessed may have contained a "dot" or period somewhere after the file extension. This is part of an old hack designed to trick the web server into displaying script code rather than executing it.

When you say "post a new message," do you mean a brand new message? Or a reply to another message? If you are attempting to reply, can you give me the message number of the message you're trying to reply to?

Harry
Notary Rotary

Reply by Korey Humphreys on 9/13/07 11:45am
Msg #210744

Hi Harry --- Msg #: 210697

When I click on my message to reply to someone else and/or add more information (clicked on "Reply in Forum", I get the "attack attempt".

Reply by SOCAL/CA on 9/13/07 12:30pm
Msg #210759

Here you go

http://www.symantec.com/avcenter/attack_sigs/s20349.html

Reply by Harry [NR] on 9/13/07 1:17pm
Msg #210763

Re: Here you go

Yep. While our web server is not susceptible to that attack, Korey's Norton nonetheless was attempting to protect us by not allowing him to click a URL that contained %2E%2E%2E...

The subject of the message he was replying to contained URL-encoded periods, which Norton evidently does not like due to that old method of attacking web sites. Now that I know what's causing it, I can start thinking about a workaround.

Harry