Solved Symantec Endpoint Protection IPS Alert

[Scot Busby]

Hello,

We have Symantec Endpoint protection running on our phone system. We have been running this on our system since we started with the 3CX system several years ago and have not had any issues.

Over the past few days, I have received a few alerts with the below details. Any thoughts on this? I have received about 4 of these emails and each has a different port. The first one I received was for port 5001. The remaining attempts were 57000+ ports. Has anyone else experienced this?

IPS Alert Name
Attack: an intrusion attempt was blocked.

Status
Blocked

Attack Signature
Web Attack: Passwd File Download Attempt

Targeted Application
C:\PROGRAM FILES\3CX PHONE SYSTEM\BIN\NGINX\NGINX.EXE

Attacking IP
127.0.0.1

Targeted IP
127.0.0.1

Targeted Port Number
63418

Targeted Host Name
N/A

 

[Saqqara]

Have you excluded the required folders - step 2 https://www.3cx.com/docs/manual/phone-system-installation-windows/

 

[Scot Busby]

Thank you - Yes, I had those folders excluded before, however, upon verification, it looks like an AV software upgrade might have removed that exclusion, so I re-added it. Since I started getting multiple of these notifications today, if they stop, I will presume this resolved.

Thanks again!