Well, port 4444 is used for quite some trojans. See my small list bellow: and there might be more out there. Port 139 is used for the NETBIOS Session Service and I would recommend closing that one on your firewall, it's also used for again quite some trojans. Check my small list bellow: 4444 tcp CrackDown [trojan] CrackDown 4444 tcp krb524 KRB524 4444 tcp nv-video NV Video default 4444 tcp Prosiak [trojan] Prosiak 4444 tcp Prosiak [trojan] Prosiak 4444 tcp SwiftRemote [trojan] Swift Remote 4444 udp krb524 4444 tcp krb524 4444 udp nv-video NV Video default 139 udp netbios-ssn NETBIOS Session Service 139 tcp Chode [trojan] Chode 139 tcp GodMessageworm [trojan] God Message worm 139 tcp Msinit [trojan] Msinit 139 tcp Netlog [trojan] Netlog 139 tcp Network [trojan] Network 139 tcp Qaz [trojan] Qaz 139 tcp Sadmind [trojan] Sadmind 139 tcp SMBRelay [trojan] SMB Relay Perhaps it is a good idea to check that windows workstation for the precense of these (or any) trojans. You could also make sure those ports are properly closed on your firewall or consider closing them? "Aditya, ALD [Aditya Lalit Deshmukh]" wrote: "Dear list, i am seeing strange traffic ... first something connects to 139 on windows workstation ... 2 packets causes the svchost tocrash. and then i start seeing traffic to port 4444 from the same ip. what is this traffic i am seeing ? any new kind of malware trying to open of port 4444 with the initial vector of infection on port139 ? the machine is fully patched and protected by firewall from outside world with a sniffer logging all the data ie scr, dst ip and ports numbers ( this is how i know the above info ) and nothing suspecipous is there on the machine also ... since the machine is under heavy watch anything unsual would be caught immediatly.... -aditya" "Aditya, ALD [Aditya Lalit Deshmukh]" wrote: > Dear list,i am seeing strange traffic ... first something connects to 139 on > windows workstation ... 2 packets causes the svchost > to crash.and then i start seeing traffic to port 4444 from the same ip.what > is this traffic i am seeing ? any new kind of malware > trying to open of port 4444 with the initial vector of infection on port 139 > ?the machine is fully patched and protected by > firewall from outside world with a sniffer logging all the data ie scr, dst > ip and ports numbers ( this is how i know the above > info ) and nothing suspecipous is there on the machine also ... since the > machine is under heavy watch anything unsual would be > caught immediatly.... -aditya > Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) >
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature