Loading...
[get complete service list]
Top of page
Port Information
Protocol Service Name
tcp sasser-ftp [trojan] Sasser Worm FTP Server
udp sgi-esphttp SGI ESP HTTP
tcp sgi-esphttp SGI ESP HTTP
Top IPs Scanning
Today Yesterday
64.39.106.79 (4)45.93.20.84 (18)
35.203.210.104 (2)79.124.62.86 (17)
79.124.62.86 (2)143.42.227.223 (16)
152.32.197.35 (2)143.42.191.230 (12)
35.203.211.220 (2)106.75.134.120 (9)
35.203.210.111 (2)64.39.106.75 (8)
45.93.20.84 (2)35.203.211.78 (8)
35.203.211.179 (2)162.216.149.73 (7)
35.203.211.178 (2)162.216.150.157 (6)
61.129.155.206 (2)162.216.149.21 (6)
Port diary mentions
URL
Increase in TCP 5554 activity; Fragmented IP traffic towards port 16191; Please patch your SymantecNorton firewall products
Samba - Buffer Overrun, HP Remote Command Execution, Top 15 Worms, Hosts File, SasserDabber Activity
Top of page
User Comments
Submitted By Date
Comment
Robert Burnett 2004-07-20 17:36:11
Recent spikes in traffic on this port are most likely caused by the Dabber worm, which spreads itself by connecting to the Sasser FTP server (port 5554) and exploiting a buffer overflow vulnerability in the FTP server.
Alan E Brain 2004-05-04 16:16:24
Used by sasser worm to spread itself. Sasser spreads by scanning IP addresses for access via TCP Port 445 looking for vulnerable systems, according to Symantec. When it finds an unpatched Windows XP or Windows 2000 computer, Sasser.A adds the file "avserve2.exe"="%Windir%avserve2.exe" in the registry, tries to block attempts to shut down or reboot the infected computer (by using the AbortSystemShutdown application programming interface) and then begins scanning other systems via an FTP server on TCP Port 5554 seeking to spread itself,
Top of page
CVE Links
CVE # Description
Top of page