RE: Suspicious network activity? Smakynet?

The port 6348 does not look right. The last time I saw a port in the 6000 
range, it was a new
version of Mytob and it was using that range of port to call home for a new 
version. If you can send
me an Ethereal packet trace I will Endeavour to pick through it. Set it up to 
start when it picks up
the port 6348 traffic. I only need a few minutes of this traffic.

Add to this list below Webroot Spysweeper. It will pick up what Spybot does 
not. I use both for
cleaning systems. Remember that a "cleaned systems" should never be a truly 
trusted system until it
is completely rebuilt.

-----Original Message-----
From: Kurt Buff [mailto:kurt.buff@gmail.com] 
Sent: Wednesday, 22 June 2005 16:35
To: Jeff Graham
Cc: firewalls@securityfocus.com
Subject: Re: Suspicious network activity? Smakynet?

Jeff Graham wrote:
> Hi list,
<snip>
> My IP address being 203.173.xxx.230. ISP claims the traffic is not 
> unusual, but I know I haven't been sending 53 million packets to port
> 122 of that or any IP address. Symantec Antivirus claims the box is 
> clean and it is fully patched.

Assuming this is a Windows box, first try Spybot Search & Destroy, then the 
MSFT Antispyware
software.

If those fail, try RootKit Revealer, from http://sysinternals.com, as well as 
AutoRuns from the same
source.

Also, take a look at silentrunners.vbs, from http://silentrunners.org.

Kurt