Re: cuebot-d infection method

One other possibility is that the attacker went straight through the
firewall using an atypical packet....... unlikely, but should be placed
on an all-inclusive roster of post-mortem investigations. 

Jayson


On Wed, 2005-08-24 at 15:36 -0400, Matt Stockdale wrote:
> Jeff -
> 
>   I've just cleaned up four machines here, all Windows 2000. We're
> scratching our heads, as the "published" propagation method is over port
> 445, which wasn't open on the firewall. 
> 
>   We suspect it may have come through the client's VPN access, or maybe
> someone wrapped this backdoor in another exploit for delivery.
> 
> Thanks,
>   Matt
> 
> On Wed, 2005-08-24 at 12:03, Jeff Bryner wrote:
> > I've seen a couple cuebot-d infections over the last couple days and am
> > trying to track down the source of them. Has anyone seen enough of this
> > to know the universe of ways the pc gets initially infected?
> > 
> > The pcs that have gotten infected have mcafee running on them  which
> > incorrectly picks it up as W32/Sdbot.worm.gen.by when a scan is
> > requested. It didn't seem to pick it up *until* a scan was requested.
> > 
> > The writeup at http://www.sophos.com/virusinfo/analyses/w32cuebotd.html
> > fits the scenario, but it doesn't say exactly what the initial
> > infection vector is.
> > 
> > Thanks for any help. 
> > 
> > Jeff
> > CISSP, GCIH, GCFA
> > 
> >