RE: new/old port 135 scans?

["Flowers, Katie" <Katie.Flowers () savvis net>]

Only nachi was programmed to self-destruct after 01/01/04, but that will
only happen if the infected machine is rebooted after said date.

Katie, ASN6347

-----Original Message-----
From: Brian Collins [mailto:listbc () newnanutilities org] 
Sent: Monday, January 12, 2004 11:26 PM
To: incidents () securityfocus com
Subject: new/old port 135 scans?


Tonight we're seeing a significant increase in scans on tcp/135.
Customers 
are sending roughly 20 packets to several incremental IPs in a class C, 
waiting 2 seconds, sending roughly 20 more, etc.  I was under the 
impression that Blaster/Nachi was programmed to cease as of 1/1/04 (of 
course, I could be wrong about that).    I'll try to have some packets 
available in a little while.  In the meantime, has anyone else noticed
an 
increase?

Thanks,
--Brian Collins 


------------------------------------------------------------------------
---
------------------------------------------------------------------------
----


---------------------------------------------------------------------------
----------------------------------------------------------------------------