Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Port 39999; Possible Vesser/W32.HLLW.Deadhat activity - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Port 39999; Possible Vesser/W32.HLLW.Deadhat activity
For the most part, it was a pretty quiet day, with just the normal noise on the Internet. Here are some things:

Port 39999

Activity to port 39999 was reported today. It appears that may be attempts to connect to a Trojan called Trojan.mitglieder.b.html that sets up a proxy on this port and is used to send spam. Once a system is infected, the Trojan will notify certain sites of the compromise. For more information see

**As a side note, don't forget that many folks connecting to the Internet use DHCP and as a result, they often inheirit the IP of someone offering services or infected by malicious code that listens on a certain port. As a result, you may see unusual and maybe persistant connection attempts to the port on your box as a result.**

Possible Vesser/W32.HLLW.Deadhat activity

More reports of activity on ports 3127, 3128 and 1080 are coming in. This seems to be consistant with the worm Vesser/W32.HLLW.Deadhat activity. For more information on this see the diary entry from 7 February 04.

Lorna Hutcheson


165 Posts
ISC Handler
Feb 9th 2004

Sign Up for Free or Log In to start participating in the conversation!