|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: Postfix and MyDoom virus problem
From: Alex van den Bogaerdt (alex
ergens.op.het.net)
Date: Thu Jan 29 2004 - 16:09:20 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Thu, Jan 29, 2004 at 12:09:09PM -0500, Jimmy Mensinger wrote:
> Not sure that this will help anyone, but it helped lead me in the right
> direction. I downloaded SuperScan 3.0 (freeware) and scanned my entire
> network for open tcp ports in the range 3127->3198. Anything listening on
> those ports is very likely to be a variant of this worm.
Erm... you may not be aware but 3128 is commonly used for squid,
the web proxy.
When port 3128 is open together with port 137 or port 445, there's
a bigger chance of having found the worm. Still, this is not sure.
cheers,
Alex
--
begin sig
http://www.googlism.com/index.htm?ism=alex+van+den+bogaerdt&type=1
This message was produced without any <iframe tags
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]