[Dshield] MSblast Version A B and C...

Chris Ream chrisr at stopthemcold.com
Thu Aug 14 16:18:35 GMT 2003


Ok, this is a strange request but I have just trapped a new version of
msblast in the wild. Looks like a version D! I will be testing this new
strain but I have a suspicion that there are others out there as well.
This one loaded as msblast.exe but it didn't have the same md5 checksum
and appears to install a backdoor on port 31337 (stupid).  

I am making a group request to send me any and all versions you have. I
will provide a web-site for anyone interested in this to download them
from. Even if you think I already have a copy of the one you have please
send it anyway. I want to be sure.

By the way, I also have the completed analysis of version A in pdf
format if anyone wants a copy.

Take care,
Chris.

Please send all virus'/worms to chrisr at stopthemcold.com (weird request
huh?)






More information about the list mailing list