Re: strange traffic ?

[KUIJPERS Jimmy <jimmy.kuijpers () swift com>]

Well, port 4444 is used for quite some trojans. See my small list bellow: and there might be more out there.  Port 139 
is used for
the NETBIOS Session Service and I would recommend closing that one on your firewall, it's also used for again quite 
some trojans.
Check my small list bellow:

4444 tcp CrackDown   [trojan] CrackDown
4444    tcp     krb524                  KRB524
4444    tcp     nv-video                NV Video default
4444    tcp     Prosiak                 [trojan] Prosiak
4444 tcp Prosiak   [trojan] Prosiak
4444 tcp SwiftRemote   [trojan] Swift Remote
4444    udp     krb524
4444    tcp     krb524
4444    udp     nv-video                NV Video default

139     udp     netbios-ssn             NETBIOS Session Service
139 tcp Chode    [trojan] Chode
139 tcp GodMessageworm   [trojan] God Message worm
139 tcp Msinit    [trojan] Msinit
139 tcp Netlog    [trojan] Netlog
139 tcp Network   [trojan] Network
139 tcp Qaz    [trojan] Qaz
139 tcp Sadmind   [trojan] Sadmind
139 tcp SMBRelay   [trojan] SMB Relay

Perhaps it is a good idea to check that windows workstation for the precense of these (or any) trojans. You could also 
make sure
those ports are properly closed on your firewall or consider closing them?



"Aditya, ALD [Aditya Lalit Deshmukh]" wrote:


"Dear list,
i am seeing strange traffic ... first something connects to 139 on windows workstation ... 2 packets causes the svchost 
tocrash.
and then i start seeing traffic to port 4444 from the same ip.

what is this traffic i am seeing ? any new kind of malware trying to open of port 4444 with the initial vector of 
infection on
port139 ?


the machine is fully patched and protected by firewall from outside world with a sniffer logging all the data ie scr, 
dst ip and
ports numbers ( this is how i know the above info )

and nothing suspecipous is there on the machine also ... since the machine is under heavy watch anything unsual would 
be caught
immediatly....


-aditya"


"Aditya, ALD [Aditya Lalit Deshmukh]" wrote:

>  Dear list,i am seeing strange traffic ... first something connects to 139 on windows workstation ... 2 packets 
> causes the svchost
> to crash.and then i start seeing traffic to port 4444 from the same ip.what is this traffic i am seeing ? any new 
> kind of malware
> trying to open of port 4444 with the initial vector of infection on port 139 ?the machine is fully patched and 
> protected by
> firewall from outside world with a sniffer logging all the data ie scr, dst ip and ports numbers ( this is how i know 
> the above
> info ) and nothing suspecipous is there on the machine also ... since the machine is under heavy watch anything 
> unsual would be
> caught immediatly.... -aditya
> Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature