Re: Worm activity/port 445

[Eric van Wiltenburg <vanwilt () UVIC CA>]

Yesterday our IPS suddenly detected a number of on-campus hosts
exploiting LSASS vulnerabilities to other on-campus hosts in our /16
address space, and then phoning home to an IRC server.

It appears to be another IRC bot, probably an SD.Bot variant (we
captured some definitive IRC traffic), and it appears a file called
"msfwe1.exe" is the culprit.

AV vendors don't seem to detect it yet, but googling shows that
virusscan.jotti.org says "behaveslike:win32.irc-backdoor" for that
filename.

Eric van Wiltenburg
Network Security Analyst
University of Victoria

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.