[unisog] sudden increase in NetBIOS probes

Kathy Bergsma kathya at nersp.nerdc.ufl.edu
Mon Jun 7 22:31:07 GMT 2004


Yes, it was korgo, but it looks like we might have been hit with a new variant.
We use McAfee and the latest DAT, 4364, didn't detect it.  We got an extra.dat
pretty quickly.  It's attached if anyone needs it.

=============
Kathy Bergsma
UF Information Security Manager
352-392-2061

On Mon, 7 Jun 2004, Peter Van Epp wrote:

> 	About 51,000 probes (all dropped) between 11 and 12 today against
> 74,000 a week ago for the same hour, so it looks less here. However back on
> Friday we lost some 18 machines to the korgo virus all of which were scanning
> very hard on port 445 out (but being dropped at the border router so not
> bothering anyone but me and now the owners of the various machines :-)) so
> you may be seeing fallout from machines infected with that.
>
> Peter Van Epp / Operations and Technical Support
> Simon Fraser University, Burnaby, B.C. Canada
>
> On Mon, Jun 07, 2004 at 03:31:50PM -0400, Kathy Bergsma wrote:
> > Anyone else seeing a sudden increase in port 445 activity today?
> >
> > =============
> > Kathy Bergsma
> > UF Information Security Manager
> > 352-392-2061
> > _______________________________________________
> > unisog mailing list
> > unisog at lists.sans.org
> > http://www.dshield.org/mailman/listinfo/unisog
> _______________________________________________
> unisog mailing list
> unisog at lists.sans.org
> http://www.dshield.org/mailman/listinfo/unisog
>
-------------- next part --------------
 287 178 156 179  77  51 218 128  63  28 198 220 127  84 226 157

 122  92 255 222 158  52 138 243  13  51 141 232 229  15  44 180

 243 126 113  22 168 150 163  76  12  71  61 177  77  62 104 188

 171  30 119  97 224 196 112  41 219  77 111 115 167 187  80  86

   2 213 224   9 159 158  58  14 215 165 179  17 141 217  69  46

 232  60 115 198 175 185  56  28 168 241   3 149 183 171 127  99

 136  62 136  49  11  50 228 142  53 204 142  49  11  50 231  97

   4 204 142  49  11  50 230 192  92 204 142 167 242  50 224 253

 242 164  45  38 158  51 141 178 158  51 141 179  65  50 141 173

  13  47 141 224  98  85 249 196 108  65 232 239  64  90 238 193

  98  64 226 213 121 111 218 218 127  86 225 214 126  64 141 247

  13  51 141 179  78  99 141 211  13  76 140 179  12  22  12 204

  14  51 140 150 140  76 143 179  12  22  12 204   9  51 140 150

 140  76 143 179 140  76 140 179 140  76 141 179 140  76 142 179

  12  22  12 204  13  51 140 150 140  76 136 179  12  22  12 204

  15  51 140 150 140  76 143 179  12  20  12 204  12  51 140 150

 140  76 141 179 140  76 140 179 140  76 141 179   6  49 141 179

 141   4 141 179  17  63 141 193 140  76  64 177  10  51 195 180



24654 256   12508  336  W32/Korgo.worm





More information about the unisog mailing list