[34713] in bugtraq
RE: New Worm??? - High level of activity on port 445
daemon@ATHENA.MIT.EDU (Roger A. Grimes)
Thu Apr 29 16:01:17 2004
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Date: Thu, 29 Apr 2004 14:19:22 -0400
Message-ID: <096A04F511B7FD4995AE55F13824B833033387@banneretcs1.local.banneretcs.com>
From: "Roger A. Grimes" <roger@banneretcs.com>
To: "Tony Abell" <TonAbe@osgtool.com>, <bugtraq@securityfocus.com>
Content-Transfer-Encoding: 8bit
Without any more details, like traffic captures, I can only assume it is
one of the new Lsass worms looking for MS04-011 vulnerable machines.
http://www.sarc.com/avcenter/venc/data/hacktool.lsasssba.html
Roger
************************************************************************
***
*Roger A. Grimes, Computer Security Consultant
*CPA, CISSP, MCSE: Security (NT/2000/2003/MVP), CNE (3/4), A+
*email: roger@banneretcs.com
*cell: 757-615-3355
*Author of Malicious Mobile Code: Virus Protection for Windows by
O'Reilly
*http://www.oreilly.com/catalog/malmobcode
*Author of upcoming Honeypots for Windows (Apress)
************************************************************************
****
-----Original Message-----
From: Tony Abell [mailto:TonAbe@osgtool.com]
Sent: Thursday, April 29, 2004 12:45 PM
To: 'bugtraq@securityfocus.com'
Subject: New Worm??? - High level of activity on port 445
Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes
coming from one machine that is probing random IPs on port 445. The
source port is random as well. We traced it back to a Japanese Win2K
machine w/SP4 installed. No idea if it's fully patched or not, I have no
desire to put it back on my network to patch it until I get this figured
out. I scanned the machine in safe mode as well as booting normally
using SAV 8.1 with 4/28/04 Rev 38 defs and came up with nothing.
Is anyone else seeing anything like this?
Tony Abell
Network Administrator
OSG Tap & Die
