[Dshield] Outbreak of a virus on campus,scanning tcp 80/6129/1025/3127

Blake McNeill mcneillb at linklogger.com
Wed Apr 21 15:52:02 GMT 2004


Jeff I would be almost willing to bet that your network filters Netbios
traffic as the typical Agobot scanning pattern hits ports 80, 135, 139, 445,
1025, 2745, 3127, 6129.  We have a vast collection of these little beasties
that we have picked up in our honey pots, and its seems every day there are
a couple of new strains.  In fact I believe that Agobot made it to triple
letters last week 'Agobot.aay'
http://securityresponse.symantec.com/avcenter/venc/data/pf/w32.gaobot.aay.html

Blake
http://www.LinkLogger.com




More information about the list mailing list