Bugtraq mailing list archives
New Worm??? - High level of activity on port 445
From: Tony Abell <TonAbe () osgtool com>
Date: Thu, 29 Apr 2004 11:44:54 -0500
Since late yesterday 4/28/04 afternoon around 4pm our firewall started throwing alarms on netprobes. We are seeing a large amount of probes coming from one machine that is probing random IPs on port 445. The source port is random as well. We traced it back to a Japanese Win2K machine w/SP4 installed. No idea if it's fully patched or not, I have no desire to put it back on my network to patch it until I get this figured out. I scanned the machine in safe mode as well as booting normally using SAV 8.1 with 4/28/04 Rev 38 defs and came up with nothing. Is anyone else seeing anything like this? Tony Abell Network Administrator OSG Tap & Die
Current thread:
- New Worm??? - High level of activity on port 445 Tony Abell (Apr 29)
- <Possible follow-ups>
- RE: New Worm??? - High level of activity on port 445 Roger A. Grimes (Apr 29)
- RE: New Worm??? - High level of activity on port 445 Jodrell Dimaculangan (Apr 29)
- RE: New Worm??? - High level of activity on port 445 Thor Larholm (Apr 29)