Hi Hoss:

You mentioned that:


But, does the worm still attack port 135? If that is the case, I have noticed an increase which started yesterday afternoon.

Have you discovered anything else?