4444 tcp CrackDown [trojan] CrackDown
4444 tcp krb524
KRB524
4444 tcp nv-video
NV Video default
4444 tcp Prosiak
[trojan] Prosiak
4444 tcp Prosiak [trojan] Prosiak
4444 tcp SwiftRemote [trojan] Swift Remote
4444 udp krb524
4444 tcp krb524
4444 udp nv-video
NV Video default
139 udp netbios-ssn
NETBIOS Session Service
139 tcp Chode [trojan] Chode
139 tcp GodMessageworm [trojan] God Message worm
139 tcp Msinit [trojan] Msinit
139 tcp Netlog [trojan] Netlog
139 tcp Network [trojan] Network
139 tcp Qaz [trojan] Qaz
139 tcp Sadmind [trojan] Sadmind
139 tcp SMBRelay [trojan] SMB Relay
Perhaps it is a good idea to check that windows workstation for the
precense of these (or any) trojans. You could also make sure those ports
are properly closed on your firewall or consider closing them?
"Aditya, ALD [Aditya Lalit Deshmukh]" wrote:
"Dear list,
i am seeing strange traffic ... first something connects to 139 on
windows workstation ... 2 packets causes the svchost tocrash.
and then i start seeing traffic to port 4444 from the same ip.
what is this traffic i am seeing ? any new kind of malware trying to
open of port 4444 with the initial vector of infection on port139 ?
the machine is fully patched and protected by firewall from outside
world with a sniffer logging all the data ie scr, dst ip and ports numbers
( this is how i know the above info )
and nothing suspecipous is there on the machine also ... since the
machine is under heavy watch anything unsual would be caught immediatly....
-aditya"
"Aditya, ALD [Aditya Lalit Deshmukh]" wrote:
Dear list,i am seeing strange traffic ... first something connects to 139 on windows workstation ... 2 packets causes the svchost to crash.and then i start seeing traffic to port 4444 from the same ip.what is this traffic i am seeing ? any new kind of malware trying to open of port 4444 with the initial vector of infection on port 139 ?the machine is fully patched and protected by firewall from outside world with a sniffer logging all the data ie scr, dst ip and ports numbers ( this is how i know the above info ) and nothing suspecipous is there on the machine also ... since the machine is under heavy watch anything unsual would be caught immediatly.... -aditya
smime.p7s
Description: S/MIME Cryptographic Signature
