From: Terence Runge (Terence.Rungeveritas.com)
Date: Mon May 17 2004 - 16:11:47 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.internetwk.com/breakingNews/showArticle.jhtml?articleID=20301309H
igh

Port 5000 Traffic Indicates Kibuv.b Worm At Work

By TechWeb News

Symantec's DeepSight Threat network Monday detected a very high level of
unusual traffic on TCP port 5000 that indicates a worm's at work.

The latest alert, which notes "extremely heavy activity" on port 5000, is
"almost certainly a worm-related activity," said Alfred Huger, the vice
president of engineering for Symantec's virus watch group.

The suspected culprit is the Kibuv.b worm, which hit the Internet over the
weekend and exploits a vulnerability in Windows' Universal Plug and Play
(UPnP) service within Windows 98, Me, and XP. The UPnP vulnerability was
first disclosed and patched in late 2001.

-----Original Message-----
From: Leonardo [mailto:lmuroyauol.com.br]
Sent: Monday, May 17, 2004 1:00 PM
To: Rohny Jotton; incidentssecurityfocus.com
Subject: Re: TCP port 5000 syn increasing

http://isc.sans.org/port_details.php?port=5000

----- Original Message -----
From: "Rohny Jotton" <rohnyjottonhotmail.com>
To: <incidentssecurityfocus.com>
Sent: Sunday, May 16, 2004 9:49 PM
Subject: TCP port 5000 syn increasing

> I'm seeing a large amount of these attempts starting around 1:00 PM EST
> Sunday. They're getting blocked at the edge so I don't have any more info
> than that. I'm seeing about one a second from various hosts/networks.
>
> isc.sans.org shows that port related to various backdoors. Someone or
> something is getting busy.
>
> _________________________________________________________________
> MSN Toolbar provides one-click access to Hotmail from any Web page - FREE
> download! http://toolbar.msn.click-url.com/go/onm00200413ave/direct/01/
>
>
> --------------------------------------------------------------------------
-
> --------------------------------------------------------------------------
--
>

---------------------------------------------------------------------------
----------------------------------------------------------------------------

---------------------------------------------------------------------------
----------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]