bugtraq - New Worm??? - High level of activity on port 445

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 29 Apr 2004 11:44:54 -0500
From: Tony Abell <TonAbe@...tool.com>
To: "'bugtraq@...urityfocus.com'" <bugtraq@...urityfocus.com>
Subject: New Worm??? - High level of activity on port 445

Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes coming
from one machine that is probing random IPs on port 445. The source port is
random as well. We traced it back to a Japanese Win2K machine w/SP4
installed. No idea if it's fully patched or not, I have no desire to put it
back on my network to patch it until I get this figured out. I scanned the
machine in safe mode as well as booting normally using SAV 8.1 with 4/28/04
Rev 38 defs and came up with nothing.

Is anyone else seeing anything like this? 

Tony Abell
Network Administrator
OSG Tap & Die