Re: track worm virus on NT/W2K machines

["Jack Whitsitt (jofny)" <seclists () violating us>]

As far as Blast.d goes, we've had excellent success using nmap or <fill in
any port scanner> to scan ports 666-765 across our address ranges. In a
primarily windows network, we've had no false positives...

Doing the same for port 4444 for the original should work fine as well.

-jofny


> > I would like some suggestion on what software to use / be good if its
> free,
> > so that I can install on one of my NT or W2K servers to track down worms
> > like the current WELCHIA, BLASTER and DUMARU. My organization networks
> are
> > currently badly hit by these worms. Please help.