Re: Phatbot

[Mike Iglesias <iglesias () DRACO ACS UCI EDU>]

> I thought I saw something about port 1025 requests but
> I can't find it now.

We've seen it probe systems on the following ports:

  135/139/445
  1025
  2745  (bagle/beagle backdoor)
  3127  (mydoom backdoor)
  6129  (Dameware vuln)
  80    (WebDAV vuln attacks)

We're pretty certain that at least one system was infected via the
bagle backdoor.

We also found several of the infected systems talking to an IRC server
on 206.222.29.51.  We had also heard that they may try to contact the
IRC server on 209.25.161.103, but we have not seen that.


Mike Iglesias                          Email:       iglesias () draco acs uci edu
University of California, Irvine       phone:       949-824-6926
Network & Academic Computing Services  FAX:         949-824-2069

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.