[Dshield] More stuff from Korea
bioh at biodome.org
Fri May 18 21:23:48 GMT 2001
10008 i believe is a variant of the li0n worm.
it is a suid shell... and you have it if you've fallen victim to the recent
'friendly' cheese worm scans for these also, but it in turn tries to turn
mike at mekkalife.com
193 henderson avenue
ottawa ontario k1n 7p7 canada
> -----Original Message-----
> From: dshield-admin at dshield.org [mailto:dshield-admin at dshield.org]On
> Behalf Of Tench, Michael
> Sent: Monday, May 14, 2001 10:58 AM
> To: 'dshield at dshield.org'
> Subject: [Dshield] More stuff from Korea
> As you know, last week a great deal of scans to 111 and 80 were
> from Asia. As it moved to other networks, it was evident that a
> worm was on
> the loose.
> I have noticed scans from many of these Asian networks looking for port
> 10008. Is there a connection?
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
More information about the list