Virus - SMB Port Scanning (Wannacry?)

dizzle · October 24, 2018, 4:07pm

@Kleintjie1 please confirm both PCs have been cleaned? 172.26.148.33 & 172.26.148.34

dizzle · October 24, 2018, 4:22pm

I have unblocked ZeroCool and @Kleintjie1
I have blocked the 2 host specified by @Wolf

Wolf · October 25, 2018, 4:08pm

New one just now

172.18.153.124 - pc.zoska.ctwug.za.net

dizzle · October 25, 2018, 6:35pm

172.18.153.124 - pc.zoska.ctwug.za.net has been blocked.

dizzle · October 25, 2018, 7:03pm

Update list of blocked machines:

  172.26.60.132	        youknowho2.youknowho.ctwug.za.net
  172.26.22.131	        pc3.shaggydogza.ctwug.za.net
  172.26.137.148	pc4.mafia.ctwug.za.net
  172.18.115.71	        snot.ctwug.za.net
  172.26.148.65	        pc-1.torax.ctwug.za.net
  172.26.152.57	        pc1.arno-3.ctwug.za.net
  172.26.27.180	        stefpc.redrbk.ctwug.za.net
  172.26.31.229	        stinge-pc.blinksnode.ctwug.za.net
  172.26.27.189	        rb2.redrbk.redrbk.ctwug.za.net
  172.18.33.14	        rb1.diego.ctwug.za.net, rb.johanvdb.ctwug.za.net
  172.18.145.203        c11.tiffie.ctwug.za.net
  172.18.123.241        pc1.wesa.ctwug.za.net
  172.18.153.124        pc.zoska.ctwug.za.net

Wolf · November 4, 2018, 8:08am

New ones just now

172.18.153.120 - laptop.zoska.ctwug.za.net
172.18.123.163 - pc3.dozer.ctwug.za.net
172.18.32.33    - pc1.randal.ctwug.za.net
172.18.145.205 - pc13.tiffie.ctwug.za.net

spin · November 4, 2018, 9:39am

I’ve blocked yours and a few more. First post i up to date with blocked ips:

172.26.60.132   youknowho2.youknowho.ctwug.za.net.
172.26.22.131   pc3.shaggydogza.ctwug.za.net.
172.26.137.148  pc4.mafia.ctwug.za.net.
172.18.115.71
172.26.148.65   pc-1.torax.ctwug.za.net.
172.26.152.57   pc1.arno-3.ctwug.za.net.
172.26.27.180   stefpc.redrbk.ctwug.za.net.
172.26.31.229   stinge-pc.blinksnode.ctwug.za.net.
172.26.27.189   rb2.redrbk.redrbk.ctwug.za.net.
172.18.33.14    rb.johanvdb.ctwug.za.net. / rb1.diego.ctwug.za.net.
172.18.145.203  pc11.tiffie.ctwug.za.net.
172.18.123.241  pc1.wesa.ctwug.za.net.
172.18.153.124  pc.zoska.ctwug.za.net.
172.18.153.120  laptop.zoska.ctwug.za.net.
172.18.123.163  pc3.dozer.ctwug.za.net.
172.18.32.33    pc1.randal.ctwug.za.net.
172.18.145.205  pc13.tiffie.ctwug.za.net.
172.18.153.120  laptop.zoska.ctwug.za.net.
172.18.187.3    pc3.gillie.ctwug.za.net.

@YouKnoWho @shaggydogza @Mafia @redrbk @Diego @tiffy @Zoska @gillie

spin · November 4, 2018, 4:54pm

Removed block as he says he cleaned it.

YouKnoWho · November 5, 2018, 6:52pm

Can you unblock my ip as I have cleaned my pc. Thanx

spin · November 5, 2018, 6:54pm

Done. Will block again if we spot more scans.

spin · November 5, 2018, 7:22pm

Also removed 172.18.115.71 as it was scanned.

shaggydogza · November 5, 2018, 7:33pm

PC scanned and clean. Nothing new has been installed, but did notice antivirus was deactivated.
Updated and scanned.All clean. Used AVG.
I must still change my email address as I am no longer with Telkom

spin · November 5, 2018, 7:33pm

Did you actually remove something?

shaggydogza · November 5, 2018, 7:41pm

This is what I found

spin · November 5, 2018, 7:42pm

OK so it cleaned something great. Will remove block now now.

shaggydogza · November 5, 2018, 7:43pm

Thanks, also changed email address

spin · November 5, 2018, 8:13pm

Removed @shaggydogza and @Zoska IPs. First post updated.

Astas · November 7, 2018, 4:39pm

Hi Spin please reactivate Thorax pc has been cleared. Fresh install of windows.

Torax1 · November 7, 2018, 6:51pm

Please unblock, did install fresh win os.
172.26.148.65 pc-1.torax

spin · November 7, 2018, 7:26pm

Unblocked this. Updating first post as well. Haven’t had a hit in a couple of days now. Let’s hope this keeps up.