question on scanning for conflicker

[RandallM <randallm () fidmail com>]

what is a common thing to notice about scanning for conflicker? One
site said a simple scan can disquish between clean and unclean ..:

"Another option is to actively scan for Conficker machines. There is a
way to distinguish infected machines from clean ones based on the
error code for some specially crafted RPC messages. Conficker tries to
filter out further exploitation attempts which results in uncommon
responses"
http://iv.cs.uni-bonn.de/wg/cs/applications/containing-conficker


Therefore, does this mean it gives what kind of response back..closes
the response or what? What "error code " will it produce?


Some results I did today using Nmap had some close it and others doing
an syn-ack back


one result:

Host 10.0.1.40 appears to be up ... good.
Scanned at 2009-03-31 15:19:19 Central Daylight Time for 2s
Interesting ports on 10.0.1.40:
PORT    STATE  SERVICE      REASON
445/tcp closed microsoft-ds reset
Final times for host: srtt: 0 rttvar: 5000  to: 100000

and then another was:

Host colossus.magnet.local (10.0.1.42) appears to be up ... good.
Scanned at 2009-03-31 15:19:19 Central Daylight Time for 4s
Interesting ports on colossus.magnet.local (10.0.1.42):
PORT    STATE SERVICE      REASON
445/tcp open  microsoft-ds syn-ack

Host script results:
|  smb-check-vulns:
|  MS08-067: NOT RUN
|  Conficker: Likely CLEAN
|_ regsvc DoS: NOT RUN (add --script-args=unsafe=1 to run)
Final times for host: srtt: 0 rttvar: 5000  to: 100000



if I understand the above results it seems the "reset" is my concern.
Others just said "no-response" meaning not open perhaps.

Anyone input for me?

-- 
been great, thanks
Big R a.k.a System
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.