[Full-Disclosure] Bagle worm status + more blocking information

From: Gadi Evron (ge_at_egotistical.reprehensible.net)
Date: 01/19/04

  • Next message: Tiziano Radice: "[Full-Disclosure] Readability of Full Disclosure communications :-)"
    To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
    Date: Mon, 19 Jan 2004 12:44:32 -0800
    
    

    Although some AV firms web pages still call this a "not so serious"
    threat, the latest checks and cross-checks between vendors which are
    members of TH-Research (The Trojan Horses Research Mailing List)
    conclude that this is a serious Outbreak.

    I believe new threat levels will be posted tomorrow morning, but it is
    no longer a *possible* outbreak, it is BIG.

    New information on the worm:

    Status of the web pages this worm tries to connect to is still unclear.

    Some vendors report it downloading a certain Trojan, but we see no
    information on that so far since the web pages status is still unclear,
    as mentioned.

    Mcafee also reports it listening on port 6777.

    The worm tries to connect to the following hacked box: 151.201.0.39.

    Finally now all AV products "speak" of this worm.
    Response times for detecting/cleaning/webpages updates were not so good.

    As I mentioned earlier, Kaspersky and The Cleaner (MooSoft) were the
    noticeable exceptions.

    FYI.

            Gadi Evron.

    The Trojan Horses Research Mailing List - http://ecompute.org/th-list

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Tiziano Radice: "[Full-Disclosure] Readability of Full Disclosure communications :-)"

    Relevant Pages

    • Bagle worm status + more blocking information
      ... I believe new threat levels will be posted tomorrow morning, ... Status of the web pages this worm tries to connect to is still unclear. ... Some vendors report it downloading a certain Trojan, ...
      (Full-Disclosure)
    • Bagle worm status + more blocking information
      ... I believe new threat levels will be posted tomorrow morning, ... Status of the web pages this worm tries to connect to is still unclear. ... Some vendors report it downloading a certain Trojan, ...
      (Bugtraq)
    • RE: [Full-Disclosure] Bagle worm status + more blocking information
      ... > I believe new threat levels will be posted tomorrow morning, ... > Status of the web pages this worm tries to connect to is still unclear. ... > Some vendors report it downloading a certain Trojan, ...
      (Full-Disclosure)
    • RE: [Full-Disclosure] Bagle worm status + more blocking information
      ... [Full-Disclosure] Bagle worm status + more blocking information ... I believe new threat levels will be posted tomorrow morning, ... Some vendors report it downloading a certain Trojan, ...
      (Full-Disclosure)
    • New Yahoo! IM Worm Emerges
      ... IM Worm Emerges ... threat from a new worm that installs a rogue Web browser called "Safety ... Browser," and hijacks the user's Internet Explorer homepage. ... installs spyware on the PC. ...
      (comp.security.misc)