[unisog] worm that looks for 139, 1433 and 2967

power less absolutelynopower at gmail.com
Sat Feb 17 18:35:13 GMT 2007


I noticed a bunch of hosts on our campus were infected yesterday with
something
which caused them to scan for 139,1433 and 2967. Anyone else see that?
Anyone have any info?
seems to me the previous round of malware that included 2967 also looked for
5900
so this could be somewhat different?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.sans.org/pipermail/unisog/attachments/20070217/c1287d69/attachment.htm 


More information about the unisog mailing list