Russ
Fri Sep 19 18:36:17 PDT 2008
See my other post..
I think you'll have to ask Trend I couldn't find it anywhere
Please post back for a solution
Thanks
Russ
--
Russell Grover - SBITS.Biz
Microsoft Gold Certified Partner
Microsoft Small Business Specialist
World Wide 24hr Remote SBS2003 Support -
http://www.SBITS.Biz
"Jeff Teel" <jdteel@RMoveThis sugardog.com> wrote in message
news:eKQHIDsGJHA.1432@TK2MSFTNGP04.phx.gbl...
> Russ, the full e-mail message that I am receive is between the two double
> lines:
> That's it. There's nothing else in it.
> ==============================================
> Subject: Virus Outbreak Monitor Alert
>
> Detect more than 10 new network sessions within 3 minutes.
>
> Detail:
> Date/Time Source
> Destination
>
> 9/19/2008 13:20:14 192.168.16.31 DELL3
> 9/19/2008 13:20:14 192.168.16.21 DELL3
> 9/19/2008 13:20:11 DELL3 SBSERVER
> 9/19/2008 13:19:13 192.168.16.32 DELL2
> 9/19/2008 13:19:13 192.168.16.21 DELL2
> 9/19/2008 13:18:29 192.168.16.32 DELL2
> 9/19/2008 13:18:25 192.168.16.31 DELL3
> 9/19/2008 13:17:58 192.168.16.31 DELL
> 9/19/2008 13:17:47 DELL1 DELL
> 9/19/2008 13:17:12 192.168.16.32 DELL2
> 9/19/2008 13:16:52 192.168.16.31 DELL
>
> =============================================
>
> Jeff
>
>
> "Russ (www.SBITS.Biz)" <support@REMOVETHIS.sbits.biz> wrote in message
> news:uYEEDorGJHA.1156@TK2MSFTNGP04.phx.gbl...
>> Great I can't find anything about "New Network Connections"
>> or what that means even...
>>
>> (I assume this is on the Console or an email sent to you?)
>> (Please post full email message.)
>>
>> And
>> I'll keep looking..
>>
>> Russ
>>
>> --
>> Russell Grover - SBITS.Biz
>> Microsoft Gold Certified Partner
>> Microsoft Small Business Specialist
>> World Wide 24hr Remote SBS2003 Support -
http://www.SBITS.Biz
>>
>>
>> "Jeff Teel" <jdteel@RMoveThis sugardog.com> wrote in message
>> news:ujskajrGJHA.3504@TK2MSFTNGP02.phx.gbl...
>>> No errors. Just email messages about the connections.
>>>
>>> Thanks Russ
>>>
>>>
>>> "Russ (www.SBITS.Biz)" <support@REMOVETHIS.sbits.biz> wrote in message
>>> news:uXklherGJHA.728@TK2MSFTNGP03.phx.gbl...
>>>>I thought these were errors
>>>> Laugh
>>>>
>>>> I'll try to find the Section and email you at your address
>>>> (Screen Shot)
>>>>
>>>> Russ
>>>>
>>>> --
>>>> Russell Grover - SBITS.Biz
>>>> Microsoft Gold Certified Partner
>>>> Microsoft Small Business Specialist
>>>> World Wide 24hr Remote SBS2003 Support -
http://www.SBITS.Biz
>>>>
>>>>
>>>> "Jeff Teel" <jdteel@RMoveThis sugardog.com> wrote in message
>>>> news:uL1x$CrGJHA.3928@TK2MSFTNGP03.phx.gbl...
>>>>> The message below is what I am emailed Russ:
>>>>> ================================================
>>>>> Detect more than 10 new network sessions within 3 minutes.
>>>>>
>>>>> Detail:
>>>>> Date/Time Source Destination
>>>>>
>>>>> 9/19/2008 13:20:14 192.168.16.31 DELL3
>>>>> 9/19/2008 13:20:14 192.168.16.21 DELL3
>>>>> 9/19/2008 13:20:11 DELL3 SBSERVER
>>>>> 9/19/2008 13:19:13 192.168.16.32 DELL2
>>>>> 9/19/2008 13:19:13 192.168.16.21 DELL2
>>>>> 9/19/2008 13:18:29 192.168.16.32 DELL2
>>>>> 9/19/2008 13:18:25 192.168.16.31 DELL3
>>>>> 9/19/2008 13:17:58 192.168.16.31 DELL
>>>>> 9/19/2008 13:17:47 DELL1 DELL
>>>>> 9/19/2008 13:17:12 192.168.16.32 DELL2
>>>>> 9/19/2008 13:16:52 192.168.16.31 DELL
>>>>>
>>>>> ==================================================
>>>>>
>>>>> Sharing a printer from the server is not practical because of the
>>>>> geographic layout of the network. The server is in the basement of a
>>>>> house. There are two workstations at the same address as the server
>>>>> but one is in an office a few hundred feet from the house and the
>>>>> other is acutually a laptop. Two other workstations are located on
>>>>> wireless bridges, one in an office that is a half mile down the road
>>>>> and the other workstation is is located in the residence of a family
>>>>> member that's just over a mile away. So it's not a typical office
>>>>> setting and you can see why sharing a printer from the server wouldn't
>>>>> work. The Vista workstation has it'spublic folder shared and that is
>>>>> it.
>>>>>
>>>>> The Trend Firewall is not enabled on workstations and Web Reputation
>>>>> is enabled and on low.
>>>>>
>>>>> Thanks
>>>>> Jeff
>>>>>
>>>>>
>>>>>
>>>>> "Russ (www.SBITS.Biz)" <support@REMOVETHIS.sbits.biz> wrote in message
>>>>> news:%23Scy8BqGJHA.5028@TK2MSFTNGP02.phx.gbl...
>>>>>> Trend gives warnings based ot type of traffic.
>>>>>>
>>>>>> What kind of workstation to workstation connections are you using?
>>>>>> Because IMO there really should be no file and print sharing between
>>>>>> the two because that's what the server is for.
>>>>>>
>>>>>> and please post the complete error
>>>>>> (And do you have the Trend Firewall on PC's and Reputation turned
>>>>>> on.)
>>>>>>
>>>>>> Thanks
>>>>>> Russ
>>>>>>
>>>>>>
>>>>>> --
>>>>>> Russell Grover - SBITS.Biz
>>>>>> Microsoft Gold Certified Partner
>>>>>> Microsoft Small Business Specialist
>>>>>> World Wide 24hr Remote SBS2003 Support -
http://www.SBITS.Biz
>>>>>>
>>>>>>
>>>>>> "Jeff Teel" <jdteel@RMoveThis sugardog.com> wrote in message
>>>>>> news:eI$KEvpGJHA.468@TK2MSFTNGP06.phx.gbl...
>>>>>>>I did forget to mention that all of the connections are from
>>>>>>>workstation to workstation in each report and occasionally from
>>>>>>>workstation to server.
>>>>>>>
>>>>>>> One other question, just where is the settings that I would adjust
>>>>>>> for the this alert? I've looked through the WFSB interface and can't
>>>>>>> seem to find anything specific to the number of new network
>>>>>>> connection.
>>>>>>>
>>>>>>> Thanks Russ and Holtz for your help.
>>>>>>> Jeff
>>>>>>>
>>>>>>>
>>>>>>> "Russ (www.SBITS.Biz)" <support@REMOVETHIS.sbits.biz> wrote in
>>>>>>> message news:uEo01fpGJHA.728@TK2MSFTNGP03.phx.gbl...
>>>>>>>> They are more sensitive than the used to
>>>>>>>> after you evaluate what is happening and find it's OK.
>>>>>>>>
>>>>>>>> I usually go and Adjust the settings.
>>>>>>>> Each client different of course.
>>>>>>>>
>>>>>>>> YMMV
>>>>>>>>
>>>>>>>> Russ
>>>>>>>>
>>>>>>>> --
>>>>>>>> Russell Grover - SBITS.Biz
>>>>>>>> Microsoft Gold Certified Partner
>>>>>>>> Microsoft Small Business Specialist
>>>>>>>> World Wide 24hr Remote SBS2003 Support -
http://www.SBITS.Biz
>>>>>>>>
>>>>>>>>
>>>>>>>> "Jeff Teel" <jdteel@RMoveThis sugardog.com> wrote in message
>>>>>>>> news:OB475PpGJHA.4564@TK2MSFTNGP02.phx.gbl...
>>>>>>>>>I upgraded Trend CSM for SMB v3.6 to WFBS on SBS for six weeks or
>>>>>>>>>so now and have recently been getting e-mail warnings from
>>>>>>>>>Officescan with a subject line of "Virus Outbreak Monitor Alert".
>>>>>>>>>The alert says that Officescan has detected more than 10 new
>>>>>>>>>network connections in the last three minuets. I get two or three
>>>>>>>>>of these Officescan e-mail messages and then they stop for a day or
>>>>>>>>> two and then I get two or three again. Trend has been protecting
>>>>>>>>> the network for over three years and has been kept current so I
>>>>>>>>> don't think there is an infection because it seems like it is when
>>>>>>>>> I'm doing certain things on a workstation that spark these. It
>>>>>>>>> almost seems like it happens when I start Real Player but I can't
>>>>>>>>> say for sure.
>>>>>>>>>
>>>>>>>>> I am just wondering if there are any settings that need adjusting
>>>>>>>>> for this or if anyone else has experienced this behavior.
>>>>>>>>>
>>>>>>>>> The network consists of SBS 2003 SP1 w/ISA 2004, three XP SP3
>>>>>>>>> workstations and one Vista Ultimate SP1 workstation.
>>>>>>>>>
>>>>>>>>> Thanks
>>>>>>>>> Jeff
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>