Re: Worm activity/port 445

[Matt Kirchhoff <mek () PDX EDU>]

Quoth Craig Blaha on 2/4/2005 11:54 AM:
> We're seeing a lot of 445 scanning and an increasing rate of infection -
> users complaining about a wide array of pop-ups, redirects and other
> spyware type symptoms, slowing their systems to a crawl.

We're seeing this as well, and have been for several months. Most of the
445 activity is a result of SDBOT (Symantec name) variants. 445 attacks
are still #1 on the ISC top 10 list (http://isc.sans.org/top10.php).

The majority of ResNet systems we see with viral infections are infected
with this, as it spreads easily through weak admin passwords *or*
Windows vulnerabilities, depending on the variant.

Generally an executable is added to Windows\System32 (WinXP) and an
entry added to the assorted "Run" keys in the registry. Executable names
vary quite a bit. Manual removal seems to be the modus operandi.

--
Matt Kirchhoff
Information Technology Consultant
User Support Services
Office of Information Technologies
Portland State University
mek () pdx edu

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.