Re: New CIFS (port 445) worm?

From: Zen (zen@kill-9.it)
Date: 12/17/02

  • Next message: james: "Re: fswserv.html ????" 
    Date: Tue, 17 Dec 2002 19:03:38 +0100
From: Zen <zen@kill-9.it>
To: David Gillett <gillettdavid@fhda.edu>

    On Tue, Dec 17, 2002 at 08:30:13AM -0800, David Gillett wrote:

            We're seeing a huge increase of tcp/445 scans on our networks
            too. For the moment, I just opened the port on my firewall to
            permit them through to a machine running tcpdump to capture all
            that's possible, to do further investigation.

    > My assumption, at this point, is that those two machines
    > (and a bunch more out on the Internet) have been infected
    > with something. The choice of port 445 suggests Win 2000/XP
    > file shares as the infection vector.

            I agree. I hope you've not wiped out the machines, as it would
            be interesting to see what, and how, is acting so to reproduce
            it and check by ourselves.

    bye, 

    -- 
My home isn't cluttered; it's "passage restrictive."
zen@kill-9.it . Geek . And proud of it .
http://www.kill-9.it/jargon/html/entry/zen.html
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

    Relevant Pages

    • Re: keep getting DCOM intrusions
      ... the XP machines, you should have the ICF firewall enabled on the ICS ... connection which would block this infection from the Internet side. ... It won't, however, prevent your bringing the infection into the network ...
      (microsoft.public.security.virus)
    • Re: ? WINS*.EXE installed as part of Windows
      ... If these files are under the path you quote, they are products of infection. ... If you connect an unpatched XP machine to the Internet without enabling the ... infected machines on the local network--even one will accomplish this. ... > each and every reboot during the install and after the second one, ...
      (microsoft.public.security.virus)
    • Re: A suggestion for next months Malicious Software Removal download
      ... Internet Service Providers are in the perfect position to kill vast ... The majority of these bots are home computers that are connected ... end user machines infected by a virus/trojan. ... >> And every time a new infection grabbed the headlines they could ...
      (microsoft.public.windowsxp.general)
    • Re: Vast Spy System Loots Computers in 103 Countries
      ... A Plan to Catch the Conficker Worm ... infected millions of machines worldwide, ... signs of infection. ... it presents itself to the wider network. ...
      (sci.military.naval)
    • Re: Why cant ISPs stop spam/virus ?!
      ... There is a scaling error and what should I look at a graph for? ... No, that would be "y", the number of machines already infected. ... >> numbers of infected machines should increase the rate of infection ... only in a quarantined area or if broadcasts were always to the same ...
      (comp.os.linux.misc)