[Intrusions] Gaobot.AOL and lrbz.us popup spam

[Joe Stewart]

On Monday 07 June 2004 10:33 pm, Carey, Steve T GARRISON wrote:
> Must be something fairly new.  As of Saturday, our top 40 incoming
> scans, per hour, are showing anywhere between 37 and 39 IP's just
> with that popup message. Maybe I  should plug a vulnerable system in
> and see what happens.....

The specific Agobot variant that sent the popup spam for www.lrbz.us is 
called Gaobot.AOL by Symantec:

http://www.sarc.com/avcenter/venc/data/w32.gaobot.aol.html

-Joe

-- 
Joe Stewart, GCIH 
Senior Security Researcher
LURHQ http://www.lurhq.com/