Find Those MyDoom Infected Machines on your network...

[Confused]

Didn't find anything on the network...hopefully it worked well and all are clean, and not a PICNIC error!!


Confused

 

[vi edit]

My network is Doomless.

Yay for me!

Cool little utility. Thanks for sharing

 

[DougK62]

Good stuff. Thanks.

 

[MustISO]

Just an FYI, symantec has a repair tool for infected machines.

 

[FoBoT]

just to clarify, this just searches for open ports that mydoom is known to create on infected boxen, it doesn't actually search the filesystem of any pc's


correct?

so if a mydoom variant were modified to use different ports, your .bat file would have to be modified to look for the new ports

 

[hevnsnt]

Originally posted by: FoBoT
just to clarify, this just searches for open ports that mydoom is known to create on infected boxen, it doesn't actually search the filesystem of any pc's


correct?

so if a mydoom variant were modified to use different ports, your .bat file would have to be modified to look for the new ports

Exactly. However all the variants so far are using the same ports.. There is a lot of talk about a second wave coming though using those ports to exploit. Also, once you have the batch, you can see how easy it is to add/remove the ports to scan.

 

[Relayer]

will this find the Mydoom.F? I have been hammered with this today.

 

[FreshPrince]

does netsky have ports also, my IDS is telling me that my mail server is sending out netsky, but I still have not been able to locate the infected user(s)

 

[amdskip]

thanks, how many will I find in this dorm building

 

[hevnsnt]

Netsky doesn't but the new mydoom.f opens port 1080, so you can fix the batch yourself..

 

[pecel]

Thanks OP

 

[WoundedWallet]

Well I spent a good part of the day with Mydoom.f, and it wasn't fun.

I still got 11 out of 500+ files infected left in a Linux server that I would rather have deleted. But got unlink errors while trying that.

If anyone has any suggestions on what to do I'll start a new thread. At least I got my ports closed. Unless they are on of them port-knocking backdoors. Them I fudged as this is an undocumented network and I can't log into the firewall.

This tool was heaven sent

 

[reicherb]

Is there anyway to pass an entire class B subnet to the scanner? I'd like to scan 10.150.x.x to 10.159.x.x.

Thanks.