[Intrusions] New SPAM Technique?

[Joe Stewart]

On Friday 04 June 2004 8:53 am, Carey, Steve T GARRISON wrote:
> Overnight we have seen an increase from 16 IP addresses to around 230
> IP addresses sending out the same pop-up message.
>
> Any chance that a spammer has a 'new' worm that propagates their
> pop-up, along with a compromise.

The Agobot variants we have seen with the popup spam capability can 
propagate via some of the classic Agobot spreading mechanisms - weak 
Netbios passwords, DCOM/DCOM2 and webdav exploits.

-Joe

-- 
Joe Stewart, GCIH 
Senior Security Researcher
LURHQ http://www.lurhq.com/