full-disclosure - Lots of traffic on port 1472 from explorer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <86AC19D1AA2E884CB9B4EB2864D719BA0E50FB4C@s1cinohhqexch05.info53.com>
From: Michael.Sottile at 53.com (Sottile, Michael)
Subject: Lots of traffic on port 1472 from explorer

klp is a keylogger. you probably have some (oak?) variant of it.  follow
this link to learn more about it/get rid of it...
http://www.pestpatrol.com/pestinfo/k/klp32.asp

regards,
~michael

-----Original Message-----
From: Giuseppe Milicia [mailto:milicia@...cs.dk]
Sent: Tuesday, September 21, 2004 3:14 PM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] Lots of traffic on port 1472 from explorer

Hi guys,

from a home computer I'm seeing lots of traffic generated from
explorer on port 1472 towards the microsoft-ds port, typically
on IP addresses starting with 35.xx.xx.xx

It looks like a worm but I could not find any references around
and Trend Micro detects nothing.

Also there is some hidden process oakklp32.exe which is not shown
by the taskmanager but is costantly active, again I could not
find anything about it!

Ideas? Clues?

Thanks,

--
Giuseppe

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

This e-mail transmission contains information that is confidential and may be privileged.   It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.