North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Port 139 scans

  • From: ken lindahl
  • Date: Wed Sep 27 14:52:51 2000

On Wed, 27 Sep 2000, Bill Becker wrote:
> Speaking of the internet and the way it operates, is anyone else seeing a
> large number of random hosts scanning through their address space using TCP
> on port 139?
> Bill

we've seen similar scans here at UCB, and have traced a number of them
to a win32 trojan variously named {,Qaz.Trojan,QAZ.worm,TROJ_QAZ.A,
Trojan/Notepad,W32.HLLW.Qaz.A}. if you're so inclined, you can test
for this by telnetting to port 7597 on the machine that scanned you. for details.