recording hits on port 445

[KpocAlypse]

Anyone know of a freeware utility that will watch and log hits on a PC from port 445 (the DCOM RPC virus port?) watching LSASS traffic wouldn't be that bad either.

Long story short, I'm fighting SDbot on a fairly large scale.

 

[InlineFive]

If you are using the Windows firewall you can log activity. In addition, you could even block the port to help reduce the amount of time required to eliminate the infection.

 

[KpocAlypse]

yea, my problem comes down to.. 3k PCs that are not under our direct control, some know what Windows Update is, some don't. So Sdbot is getting quite plentiful. MY thought was just takeing a laptop, installing some sort of application that will watch for hits on that port, and sit it on a VLAN for 20-30 minutes.

And its driveing our NBAR implementation nuts.

EDIT: SNORT was my first guess, but i was hoping on something abit well, idoit proof.

 

[InlineFive]

If it's 3k PCs I would hope that the admins had a better control over then, 3k administrator accounts is bad thing.

If they had managed switches I would tell the switches to block all 445 traffic. Period. This would stop it from spreading any more once you clean a PC.
Get a good anti-malware solution from someone like Trend.

 

[spidey07]

Originally posted by: PorBleemo
If it's 3k PCs I would hope that the admins had a better control over then, 3k administrator accounts is bad thing.

If they had managed switches I would tell the switches to block all 445 traffic. Period. This would stop it from spreading any more once you clean a PC.
Get a good anti-malware solution from someone like Trend.

and probably break a whole bunch of stuff in the process. windows needs 445.

there are scanners out there to see what machines have and haven't been patched.

iss.net makes a good one (retina) and even microsoft has a scanner for that vulnerability I believe.

 

[n0cmonkey]

tcpdump port 445

 

[n0cmonkey]

Originally posted by: spidey07

Originally posted by: PorBleemo
If it's 3k PCs I would hope that the admins had a better control over then, 3k administrator accounts is bad thing.

If they had managed switches I would tell the switches to block all 445 traffic. Period. This would stop it from spreading any more once you clean a PC.
Get a good anti-malware solution from someone like Trend.

and probably break a whole bunch of stuff in the process. windows needs 445.

there are scanners out there to see what machines have and haven't been patched.

iss.net makes a good one (retina) and even microsoft has a scanner for that vulnerability I believe.

The more I use them the less and less I like vulnerability scanners.