Re: use Nmap to find W32/Bagle.e@MM ?

[Jeff Kell <jeff-kell () UTC EDU>]

Scott Weeks wrote:

> Is this a suffucient method to find the W32/Bagle.e@MM infected machines?
>
>    [root@localhost root]# nmap -P0 -p 2745 111.222.111.0/24
>
> I see too many of these to believe as many machines as I've found are all
> infected.  At least I HOPE so...
>
>    Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
>    Interesting ports on  (111.222.111.222):
>    Port       State       Service
>    2745/tcp   filtered    unknown
>
> They all say "filtered" on this port.  That's what's throwing me off...

"Filtered" means the machine is up but a SYN is silently discarded with
no resulting ACK or ICMP unreachable.  The backdoor may have a "secret
handshake" to get it to do anything.

Jeff

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.