Incident:
From Block list checker: http://www.spamhaus.org/lookup/
CBL Lookup Utility
Automated/scripted bulk lookups are forbidden. Upon detection, automated
scripts will be denied access, and the source IP
may be listed
in the CBL.
IP Address xxx.xxx.xxx.xxx
is listed in the CBL. It appears to
be infected with a spam sending trojan, proxy or some other form of botnet.
It was last detected at 2014-04-04 17:00 GMT (+/- 30 minutes), approximately
4 days, 14 hours, 30 minutes ago.
It has been relisted following a previous removal at 2014-04-03 03:42 GMT (6
days, 3 hours, 20 minutes ago)
This IP is infected (or NATting for a computer that is infected) with the
Conficker botnet.
Solution: Using nmap to scan problem computer
Example Usage
# Run the scripts against host(s) that appear to be Windows
nmap --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args=safe=1 -T4 -vv -p445 <host>
sudo nmap -sU -sS --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args=safe=1 -vv -T4 -p U:137,T:139 <host>
# Run the scripts against all active hosts (recommended)
nmap -p139,445 -vv --script p2p-conficker,smb-os-discovery,smb-check-vulns --script-args=checkconficker=1,safe=1 -T4 <host>
# Run scripts against all 65535 ports (slow)
nmap --script p2p-conficker,smb-os-discovery,smb-check-vulns -p- --script-args=checkall=1,safe=1 -vv -T4 <host>
# Base checks on a different ip address (NATed)
nmap --script p2p-conficker,smb-os-discovery -p445 --script-args=realip=\"192.168.1.65\" -vv -T4 <host>
Script Output
Clean machine (results printed only if extra verbosity ("-vv")is specified):
Host script results:
| p2p-conficker: Checking for Conficker.C or higher...
| | Check 1 (port 44329/tcp): CLEAN (Couldn't connect)
| | Check 2 (port 33824/tcp): CLEAN (Couldn't connect)
| | Check 3 (port 31380/udp): CLEAN (Failed to receive data)
| | Check 4 (port 52600/udp): CLEAN (Failed to receive data)
|_ |_ 0/4 checks: Host is CLEAN or ports are blocked
Infected machine (results always printed):
Host script results:
| p2p-conficker: Checking for Conficker.C or higher...
| | Check 1 (port 18707/tcp): INFECTED (Received valid data)
| | Check 2 (port 65273/tcp): INFECTED (Received valid data)
| | Check 3 (port 11722/udp): INFECTED (Received valid data)
| | Check 4 (port 12690/udp): INFECTED (Received valid data)
|_ |_ 4/4 checks: Host is likely INFECTED
Source info from http://nmap.org/nsedoc/scripts/p2p-conficker.html
