Re: Worm activity/port 445

[Gary Flynn <flynngn () JMU EDU>]

Our IDP has been blocking MSN put and get messages
containing this:
http://www.securityfocus.com/news/10424?ref=rss
Shortly after a successful get, we would see
clients phoning IRC servers.

The IDPs are also blocking requests for
bestfriends.scr from lots of different web sites,
some presumably hacked. I downloaded a copy
and submitted it to Symantec and they put out a
RapidRelease for it. They identified it as a
version of SDBot. I submitted it to virustotal
and only a couple folks recognized it, all as
old sd/agobot variants.

A few months ago, Bestfriends.scr was used in AIM
buddy or away messages (I can't remember which)
to entice people to download malware. Not sure
if that is where this is originating or not. Our
IDP isn't triggering on those extensions in AIM
messages though.

Either one may explain scanning.



--
Gary Flynn
Security Engineer
James Madison University

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.