Re: Outbreak of a virus on campus, scanning tcp 80/6129/1025/3127

From: Charles Hamby (fixer_at_gci.net)
Date: 04/21/04

  • Next message: Bojan Zdrnja: "RE: Outbreak of a virus on campus, scanning tcp 80/6129/1025/3127"
    Date: Wed, 21 Apr 2004 06:51:09 -0800
    To: Jeff Kell <jeff-kell@utc.edu>
    
    

    Jeff Kell wrote:

    > Charles Hamby wrote:
    >
    >> Jeff,
    >>
    >> Aside from the scanning order this sounds remarkably like a bug that
    >> we're battling right now. It's taken out about 150 or so of of our
    >> hosts. As of right now we don't know what the bug is, but we
    >> deployed a honeypot yesterday to try to capture the malware and see
    >> if we can ID the beast.
    >
    >
    > It appears to be a Gaobot derivative. Changes the home page to be
    > <semi-random-chars>.t.muxa.cc. Google for muxa.cc and you'll get some
    > pointers.
    >
    > Jeff
    >
    >
    I assume this means you've managed to capture a sample? If so can you
    provide any details (e.g. vector, method of compromise, etc.). Like you
    I'm figuring on one of the 04-0xx vulns, but I'd like to know for sure.

    -cdh

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------


  • Next message: Bojan Zdrnja: "RE: Outbreak of a virus on campus, scanning tcp 80/6129/1025/3127"

    Relevant Pages

    • Re: Access 2003 - Table Linking
      ... Many thanks Jeff, ... Mike Thomas ... > It is a bug. ... > Linked Table Manager Wizard in a database in Access 2003: ...
      (microsoft.public.access.gettingstarted)
    • Re: Report Page Setup Keeps Changing Bug
      ... If you are using Access 2000 this is a known bug and is documented ... 240826 'Lost Printer Settings when Name Autocorrect is turned on' ... After that it would be wise to continue updating to Service Pack 3 ... Jeff Conrad ...
      (microsoft.public.access.reports)
    • Re: Access 2007 closes my dropdown
      ... the cbobox drop down and close ... There's definitely a bug here. ... Jeff Conrad - Access Junkie - MVP Alumnus ... Co-author - Microsoft Office Access 2007 Inside Out ...
      (microsoft.public.access.gettingstarted)
    • Re: Error in Inintial Replication
      ... Jeff ... > I did a Google search on this, and the common reply is to check collation. ... Appears to be a bug. ... >> Looking for a SQL Server replication book? ...
      (microsoft.public.sqlserver.server)
    • RE: Alvin Help Please !! OWC Chart Series colors not persistant after
      ... I have the screenshots of the bug and have zipped them up. ... "Jeff Moore" wrote: ... > In my OWC11 Chart control it is reporting on a OLAP cube. ...
      (microsoft.public.office.developer.web.components)