Wireshark · Ethereal-users: Re: [Ethereal-users] microsoft-ds [SYN] frames flooding my system

[Jonathan Sanders <jonathan@xxxxxxxxxxxxx>]

See this all the time here at the ISP where I work...

Most the time it's a Sasser variant trying to initiate outbound 
connections. Or Blaster maybe. If I remember right it's trying to make a 
connection to a server to download a backdoor to install opening up a 
port on your box to the outside world. Then again, all depends on the 
virus. For sure virus traffic though...

Jonathan


Harrison, Bruce wrote:
> I use Ethereal on my Linux routers.  At one location, we are flooded, from several users, with microsoft-ds [SYN] frames going to numerous ipaddresses outside our systems.  Most of the outside addresses are black holes (192.168.128.214, etc).
>
> I think it is part of the Fizzer Worm Virus associated with AOL IM and IRC, but am not sure.
>
> Can anyone shed light on what this microsoft-ds [SYN] is and where I can go to find more information?
>
> Thanks,
> Bruce Harrison
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users