[Full-Disclosure] strange traffic ?
fulldis at jackmccarthy.com
Fri Mar 26 21:04:33 GMT 2004
More details are definitely needed, but let me ask a very basic question...is
it safe to assume that you're running some sort of AV software? You're not
infected with a Blaster varient, right?
--- "Aditya, ALD [Aditya Lalit Deshmukh]"
<aditya.deshmukh at online.gateway.technolabs.net> wrote:
> Dear list,
> i am seeing strange traffic ... first something connects to 139 on windows
> workstation ... 2 packets causes the svchost to crash.
> and then i start seeing traffic to port 4444 from the same ip.
> what is this traffic i am seeing ? any new kind of malware trying to open of
> port 4444 with the initial vector of infection on port 139 ?
> the machine is fully patched and protected by firewall from outside world
> with a sniffer logging all the data ie scr, dst ip and ports numbers ( this
> is how i know the above info )
> and nothing suspecipous is there on the machine also ... since the machine is
> under heavy watch anything unsual would be caught immediatly....
> Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)
Full-Disclosure is hosted and sponsored by Secunia.