Re: what are these?

[peter.bates () LSHTM AC UK (Peter Bates)]

Hello there...

> What are generating these and why do they (mostly) seem to come from
> btinternet.com (sidebar - why don't BT ever bother to answer my questions)?
>
> This is a small sample, I get varying numbers of these every day.
>
> Mar 16 21:23:13 gate iplog[10085]: UDP: dgram to port 2140 from
> host213-1-128-105.btinternet.com:60000 (2 data bytes)
> Mar 16 22:34:38 gate iplog[10085]: UDP: dgram to port 2140 from
> host5-99-47-84.btinternet.com:60000 (2 data bytes)
> Mar 16 23:18:14 gate iplog[10085]: UDP: dgram to port 2140 from
> host62-6-69-21.btinternet.com:60000 (2 data bytes)

This is a probe for the Windows trojan 'Deep Throat',
unless I'm mistaken, which is apparently at version 3 (?)...

You're not alone... we've seen on average about
two scans a day for this across all of our network,
which tends to make it stand out a bit... and not
all of the sources are btinternet.com, however...


--
---------------------------------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-927 2124 / Fax:0207-436 5389 / Pager: 07625 255362