Re: Sasser Worm exploiting MS04-011 vulnerabilities

Article View: be.comp.security

Article #938

#938

From: Jan Reilink
Date: Sun, 02 May 2004 21:06

30 lines
1869 bytes

s|b wrote:
> On Sat, 01 May 2004 18:19:12 GMT, Filbert wrote:
> 
> 
>>Ik zie momenteel reeds verschillende probes per minuut op TCP/445 van
>>besmette machines.
> 
> 
> Op TCP/445 en TCP/9996 is hier voorlopig niets te zien, maar ik krijg
> ik wel heel wat (= minstens 1 per minuut) pogingen te zien op
> TCP/2886.
> 

net3-nl-mail-02:~# grep "\:445" /var/log/kernel |wc -l
     765

Ik zie voornamelijk veel connecties vanuit 213.x.x.x. (maar da's een flink 
opgedeelt block ;-))

> Wat Sasser betreft, Microsoft heeft gisteren ook nog een pagina online
> gezet: <http://www.microsoft.com/security/incident/sasser.asp>
> 

Groeten, Jan

-- 
/"\  ASCII Ribbon Campaign
\ /  No HTML in mail or news!
  X
/ \ 	Dutch Security Information Network: http://www.dsinet.org

Technical Details

Message-ID: <409562e7$0$564$e4fe514c@news.xs4all.nl>

Path:

arc1-ca.pugleaf.net!controlnews3.google.com!news1.google.com!news.glorb.com!newsgate.cistron.nl!transit.news.xs4all.nl!not-for-mail

References: <10033547.yWgGLQC1Ax@127.0.0.1> <d6n9905lov6djfe3p5l3o6ctvumlhfg5f2@4ax.com>

Show Full Headers

Complete Article Headers

X-Google-Language: DUTCH,ASCII-7-bit
X-Google-Thread: 113446,bf061752b2fb928f
X-Google-Attributes: gid113446,public
Path: arc1-ca.pugleaf.net!controlnews3.google.com!news1.google.com!news.glorb.com!newsgate.cistron.nl!transit.news.xs4all.nl!not-for-mail
Date: Sun, 02 May 2004 23:06:47 +0200
From: Jan Reilink <digiover@dsinet.org>
Organization: Dutch Security Information Network
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3.1) Gecko/20030425
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: be.comp.security
Subject: Re: Sasser Worm exploiting MS04-011 vulnerabilities
References: <10033547.yWgGLQC1Ax@127.0.0.1> <d6n9905lov6djfe3p5l3o6ctvumlhfg5f2@4ax.com>
In-Reply-To: <d6n9905lov6djfe3p5l3o6ctvumlhfg5f2@4ax.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Lines: 31
Message-ID: <409562e7$0$564$e4fe514c@news.xs4all.nl>
NNTP-Posting-Date: 02 May 2004 23:06:47 CEST
NNTP-Posting-Host: 80.126.245.197
X-Trace: 1083532007 news.xs4all.nl 564 [::ffff:80.126.245.197]:18180
X-Complaints-To: abuse@xs4all.nl

Reply to Parent Message