worm information

Sat Apr 10 15:35:51 UTC 2004

Hello,

Over the last few days I've seen a number of hosts attempt to initiate TCP
connections to the following ports in sequence.

80
139
445
6129
3127
1025
135
2745
...repeat.

At this moment I haven't seen a correlation between this activity and the
port exploitation list on CERT.  Any insight would be appreciated, thank
you.

Regards,
Christopher J. Wolff, VP CIO
Broadband Laboratories, Inc.
http://www.bblabs.com