Threat Level: green Handler on Duty: Daniel Wesemann

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Nachia Decline; Increased Activity on Port 1026

Published: 2004-01-02
Last Updated: 2005-09-13 13:07:12 UTC
by Lorna Hutcheson (Version: 1)
0 comment(s)

There is not alot going on today on the Internet, even traffic on port 80 was down. However, there are a couple of things worth mentioning. Nachia Decline
Now that 2004 has arrived, we should see traffic for Nachia on the decline. As more systems get rebooted in 2004, Nachia should turn itself off on the rebooted system.
Increased Activity on Port 1026
There is an increase in traffic on port 1026.

http://isc.incidents.org/port_details.html?port=1026
This port has nterm service as well as Microsoft's Task Scheduler RPC service running on it. (Scheduler only listens on this port for NT/2000 systems and uses Port 1025 for XP) It has also been part of the ports used in the pop-up messenger spam. It is worth watching. If anyone is seeing traffic destined for this port, let us know.
Lorna Hutcheson
Keywords:
0 comment(s)
Diary Archives