| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
From: jimmy.kuijpers at swift.com (KUIJPERS Jimmy) Subject: strange traffic ? Well, port 4444 is used for quite some trojans. See my small list bellow: and there might be more out there. Port 139 is used for the NETBIOS Session Service and I would recommend closing that one on your firewall, it's also used for again quite some trojans. Check my small list bellow: 4444 tcp CrackDown [trojan] CrackDown 4444 tcp krb524 KRB524 4444 tcp nv-video NV Video default 4444 tcp Prosiak [trojan] Prosiak 4444 tcp Prosiak [trojan] Prosiak 4444 tcp SwiftRemote [trojan] Swift Remote 4444 udp krb524 4444 tcp krb524 4444 udp nv-video NV Video default 139 udp netbios-ssn NETBIOS Session Service 139 tcp Chode [trojan] Chode 139 tcp GodMessageworm [trojan] God Message worm 139 tcp Msinit [trojan] Msinit 139 tcp Netlog [trojan] Netlog 139 tcp Network [trojan] Network 139 tcp Qaz [trojan] Qaz 139 tcp Sadmind [trojan] Sadmind 139 tcp SMBRelay [trojan] SMB Relay Perhaps it is a good idea to check that windows workstation for the precense of these (or any) trojans. You could also make sure those ports are properly closed on your firewall or consider closing them? "Aditya, ALD [Aditya Lalit Deshmukh]" wrote: "Dear list, i am seeing strange traffic ... first something connects to 139 on windows workstation ... 2 packets causes the svchost tocrash. and then i start seeing traffic to port 4444 from the same ip. what is this traffic i am seeing ? any new kind of malware trying to open of port 4444 with the initial vector of infection on port139 ? the machine is fully patched and protected by firewall from outside world with a sniffer logging all the data ie scr, dst ip and ports numbers ( this is how i know the above info ) and nothing suspecipous is there on the machine also ... since the machine is under heavy watch anything unsual would be caught immediatly.... -aditya" "Aditya, ALD [Aditya Lalit Deshmukh]" wrote: > Dear list,i am seeing strange traffic ... first something connects to 139 on windows workstation ... 2 packets causes the svchost > to crash.and then i start seeing traffic to port 4444 from the same ip.what is this traffic i am seeing ? any new kind of malware > trying to open of port 4444 with the initial vector of infection on port 139 ?the machine is fully patched and protected by > firewall from outside world with a sniffer logging all the data ie scr, dst ip and ports numbers ( this is how i know the above > info ) and nothing suspecipous is there on the machine also ... since the machine is under heavy watch anything unsual would be > caught immediatly.... -aditya > Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040326/ea6f9449/attachment.html -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 1477 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040326/ea6f9449/smime.bin
Powered by blists - more mailing lists