Security → What does this mean?

I was reviewing my logs in NIS 2004, and I keep getting entries like this, they way it reads to me its my like my computer is doing the intruding.

So what does it mean?

Details: Attempted Intrusion "HTTP_ActivePerl_Overflow" from your machine against ehg-sonycomputer.hitbox.com(64.154.80.250) was detected and blocked
Intruder: localhost(4392)
Risk Level: Medium
Protocol: TCP
Attacked IP: ehg-sonycomputer.hitbox.com(64.154.80.250)
Attacked Port: http(80)

anyone know?

Are you a perl user ?

According to Symantec\NIS....along with the other info found at the below link....this may also be a false positive.

HTTP_ActivePerl_Overflow

said by Symantec:

---

False Positive

This signature may not indicate malicious intent if ActivePerl versions other than those listed above are used or ActivePerl is not used at all. In this case, you can exclude this signature from monitoring.

---

Well to be honest, I dont know what perl is, could you explain?

thanks

said by nyteeyes1:

---

Well to be honest, I dont know what perl is, could you explain?

---

Sorry....I was hoping the NIS FAQ would useful info but the only perl I know about has an a in it and I only know about that kind because my lovely wife wants me to get her some. Hopefully the perl guys will speak up.

Your wife and every other wife out there it seems. Found this if it helps.»www.activestate.com/Prod ··· dex.plex

Im still not sure if I have it though.

said by nyteeyes1:

---

Im still not sure if I have it though.

---

If you're not sure you have it, then you don't.

Perl is a scripting language commonly used in *nix environments and for CGI applications on the web. (CGI apps can be written in other languages, but Perl is most common) ActivePerl is a Windows perl interpreter, used to run perl scripts on Windows machines. It is a third-party software program, and does not ship with Windows.

The Symantec page says you can disable monitoring for this event. You should consider doing that.

Thanks, I will do that.