Full Disclosure mailing list archives
Re: Lots of traffic on port 1472 from explorer
From: Harlan Carvey <keydet89 () yahoo com>
Date: Tue, 21 Sep 2004 14:04:01 -0700 (PDT)
Giuseppe,
from a home computer I'm seeing lots of traffic generated from explorer on port 1472 towards the microsoft-ds port, typically on IP addresses starting with 35.xx.xx.xx
This isn't clear...is it coming from a system you have control of? I'm going to assume that this is the case, since it seems you were able to run some kind of port to process mapping tool.
It looks like a worm but I could not find any references around and Trend Micro detects nothing.
What makes you say that it looks like a worm? What kind of activity are you seeing? Do you have captures?
Also there is some hidden process oakklp32.exe which is not shown by the taskmanager but is costantly active, again I could not find anything about it!
How is the process hidden? Just b/c it doesn't appear in the Task Manager doesn't mean that it's hidden...after all, you found it somehow. And I'm not surprised that you're not finding anything about it, as processes can be named anything.
Ideas? Clues?
Where is the executable located on your system? Do you have a copy of it? If not, why? If you do, have you run strings.exe against the file, or have you done any other analysis? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Lots of traffic on port 1472 from explorer Giuseppe Milicia (Sep 21)
- Re: Lots of traffic on port 1472 from explorer Harlan Carvey (Sep 21)
- Re: Lots of traffic on port 1472 from explorer Giuseppe Milicia (Sep 21)
- Re: Lots of traffic on port 1472 from explorer Harlan Carvey (Sep 21)
- Re: Lots of traffic on port 1472 from explorer Manohar G Singh (Sep 21)
- Re: Lots of traffic on port 1472 from explorer Giuseppe Milicia (Sep 22)
- Re: Lots of traffic on port 1472 from explorer GuidoZ (Sep 22)
- Re: Lots of traffic on port 1472 from explorer Giuseppe Milicia (Sep 21)
- Re: Lots of traffic on port 1472 from explorer GuidoZ (Sep 21)
- Re: Lots of traffic on port 1472 from explorer Harlan Carvey (Sep 21)
- <Possible follow-ups>
- RE: Lots of traffic on port 1472 from explorer Sottile, Michael (Sep 21)