SIM server scans the whole internet starting with ip address 0001.....????

[Phong Thai_2]

We're currently having a problem with our SIM server but not sure where to look? Has anyone experienced this problem? We were informed by Data Security people that our SIM server is scanning the internet starting with IP address 0001 and keep going, which means it will hit every site out there. How do we stop this without having to shutdown the server?

We're currently running SIM4.2 SP2 on Windows 2000.

[David Claypool]

Options --> Discovery --> Automatic Discovery

If you have an active discovery going on, you can stop it from this page. What do you have entered in the subnet range to scan box?

[Phong Thai_2]

Automatic discovery is disabled, and I don't have a specific range of IP addresses. The server is not only scan our network but also the internet from the outside. What about automatic update of Version control repository? How does it know where to get the update from?

[David Claypool]

VCRM visits a hard-coded address on ftp.compaq.com so that isn't it. There is no other broadcast or scanning mechanism that is part of HP SIM or any of the adjunct programs or any of the ProLiant Essentials.

What else is installed on the box?

[Phong Thai_2]

This server is specifically use for SIM. Other softwares that are on the server - Mcafee, Veritas NetBackup, and SQL 2000. It may be just a coincidence, but it started doing this just yesterday right after I upgraded the VCRM to the latest version and enabled the automatic update in the process. That's why I asked whether automatic update has anything to do with this. At this point, the server has been blocked from scanning the internet by our data security people.

[David Claypool]

I suggest opening a case with customer services at 1-800-hp-invent and say "insight manager" when prompted.

[Phong Thai_2]

I did find a virus on the machine about an hour ago, but I don't know if that was a culprit since McAfee documentation does not say anything about the virus will scan the internet.

The virus is sdbot.worm.gen.h. If anyone has more info on this virus, please let me know.

I will ask our data security people to unblock the server and see if it still tries to scan the internet.

[David Claypool]

Yes, that's assuredly the problem:

http://vil.nai.com/vil/content/v_100454.htm

"The worm scans random IP subnets for machines present on the network."