Re: Sasser Worm exploiting MS04-011 vulnerabilities

Article View: be.comp.security

Article #936

#936

From: Filbert
Date: Sun, 02 May 2004 16:53

28 lines
1878 bytes

s|b wrote:

> On Sat, 01 May 2004 18:19:12 GMT, Filbert wrote:
> 
>> Ik zie momenteel reeds verschillende probes per minuut op TCP/445 van
>> besmette machines.
> 
> Op TCP/445 en TCP/9996 is hier voorlopig niets te zien, maar ik krijg
> ik wel heel wat (= minstens 1 per minuut) pogingen te zien op
> TCP/2886.
> 

TCP/445 staat bij TN inbound dicht imho.
TCP/9996 wordt maar geprobed bij de besmetting.

besmette machines hebben een ftp-backdoor op TCP/5554.


> Wat Sasser betreft, Microsoft heeft gisteren ook nog een pagina online
> gezet: <http://www.microsoft.com/security/incident/sasser.asp>
> 

Jaja, dweilen met de kraan open  :)


-- 
echo "+++ATH0filb@+++ATH0linuxmail.org" | sed 's/+++ATH0//g'
 "Entropy just isn't what it used to be."

Technical Details

Message-ID: <2362341.vB9tCPlMFq@127.0.0.1>

Path:

arc1-ca.pugleaf.net!controlnews3.google.com!news2.google.com!news.maxwell.syr.edu!newsfeed.icl.net!newsfeed.fjserv.net!nnx.oleane.net!oleane!feed.ac-versailles.fr!nerim.net!aotearoa.belnet.be!news.belnet.be!ossa.telenet-ops.be!phobos.telenet-ops.be.POSTED!not-for-mail

References: <10033547.yWgGLQC1Ax@127.0.0.1> <d6n9905lov6djfe3p5l3o6ctvumlhfg5f2@4ax.com>

Show Full Headers

Complete Article Headers

X-Google-Language: DUTCH,ASCII-7-bit
X-Google-Thread: 113446,bf061752b2fb928f
X-Google-Attributes: gid113446,public
Message-ID: <2362341.vB9tCPlMFq@127.0.0.1>
From: Filbert <filbert@spam.la>
Subject: Re: Sasser Worm exploiting MS04-011 vulnerabilities
Newsgroups: be.comp.security
Reply-To: +++ATH0filb@+++ATH0linuxmail.org
References: <10033547.yWgGLQC1Ax@127.0.0.1> <d6n9905lov6djfe3p5l3o6ctvumlhfg5f2@4ax.com>
Lines: 28
Organization: .
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7Bit
X-No-Archive: yes
X-Newsreader: nc [v1.10]
Date: Sun, 02 May 2004 16:53:25 GMT
NNTP-Posting-Host: 213.224.229.240
X-Complaints-To: abuse@telenet.be
X-Trace: phobos.telenet-ops.be 1083516805 213.224.229.240 (Sun, 02 May 2004 18:53:25 MEST)
NNTP-Posting-Date: Sun, 02 May 2004 18:53:25 MEST
Path: arc1-ca.pugleaf.net!controlnews3.google.com!news2.google.com!news.maxwell.syr.edu!newsfeed.icl.net!newsfeed.fjserv.net!nnx.oleane.net!oleane!feed.ac-versailles.fr!nerim.net!aotearoa.belnet.be!news.belnet.be!ossa.telenet-ops.be!phobos.telenet-ops.be.POSTED!not-for-mail

Reply to Parent Message