bugtraq - RE: New Worm??? - High level of activity on port 445

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <096A04F511B7FD4995AE55F13824B833033387@banneretcs1.local.banneretcs.com>
Date: Thu, 29 Apr 2004 14:19:22 -0400
From: "Roger A. Grimes" <roger@...neretcs.com>
To: "Tony Abell" <TonAbe@...tool.com>, <bugtraq@...urityfocus.com>
Subject: RE:  New Worm??? - High level of activity on port 445

Without any more details, like traffic captures, I can only assume it is
one of the new Lsass worms looking for MS04-011 vulnerable machines.  

http://www.sarc.com/avcenter/venc/data/hacktool.lsasssba.html

Roger

************************************************************************
***
*Roger A. Grimes, Computer Security Consultant 
*CPA, CISSP, MCSE: Security (NT/2000/2003/MVP), CNE (3/4), A+
*email: roger@...neretcs.com
*cell: 757-615-3355
*Author of Malicious Mobile Code:  Virus Protection for Windows by
O'Reilly
*http://www.oreilly.com/catalog/malmobcode
*Author of upcoming Honeypots for Windows (Apress)
************************************************************************
****

-----Original Message-----
From: Tony Abell [mailto:TonAbe@...tool.com] 
Sent: Thursday, April 29, 2004 12:45 PM
To: 'bugtraq@...urityfocus.com'
Subject: New Worm??? - High level of activity on port 445

Since late yesterday 4/28/04 afternoon around 4pm our firewall started
throwing alarms on netprobes. We are seeing a large amount of probes
coming from one machine that is probing random IPs on port 445. The
source port is random as well. We traced it back to a Japanese Win2K
machine w/SP4 installed. No idea if it's fully patched or not, I have no
desire to put it back on my network to patch it until I get this figured
out. I scanned the machine in safe mode as well as booting normally
using SAV 8.1 with 4/28/04 Rev 38 defs and came up with nothing.

Is anyone else seeing anything like this? 

Tony Abell
Network Administrator
OSG Tap & Die