[34712] in bugtraq
New Worm??? - High level of activity on port 445
daemon@ATHENA.MIT.EDU (Tony Abell)
Thu Apr 29 14:44:46 2004
Message-ID: <B20BD1075983D7119F1100508BAE5344011E099E@mailserver.osgtool.com>
From: Tony Abell <TonAbe@osgtool.com>
To: "'bugtraq@securityfocus.com'" <bugtraq@securityfocus.com>
Date: Thu, 29 Apr 2004 11:44:54 -0500
MIME-Version: 1.0
Content-Type: text/plain
Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes coming
from one machine that is probing random IPs on port 445. The source port is
random as well. We traced it back to a Japanese Win2K machine w/SP4
installed. No idea if it's fully patched or not, I have no desire to put it
back on my network to patch it until I get this figured out. I scanned the
machine in safe mode as well as booting normally using SAV 8.1 with 4/28/04
Rev 38 defs and came up with nothing.
Is anyone else seeing anything like this?
Tony Abell
Network Administrator
OSG Tap & Die
