Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Nachia Decline; Increased Activity on Port 1026 - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Nachia Decline; Increased Activity on Port 1026

There is not alot going on today on the Internet, even traffic on port 80 was down. However, there are a couple of things worth mentioning. Nachia Decline
Now that 2004 has arrived, we should see traffic for Nachia on the decline. As more systems get rebooted in 2004, Nachia should turn itself off on the rebooted system.
Increased Activity on Port 1026
There is an increase in traffic on port 1026.
This port has nterm service as well as Microsoft's Task Scheduler RPC service running on it. (Scheduler only listens on this port for NT/2000 systems and uses Port 1025 for XP) It has also been part of the ports used in the pop-up messenger spam. It is worth watching. If anyone is seeing traffic destined for this port, let us know.
Lorna Hutcheson

165 Posts
ISC Handler
Sep 13th 2005

Sign Up for Free or Log In to start participating in the conversation!