[Dshield] New virus?

Daniel Gerald Kluge dkluge at acm.org
Sat Mar 8 16:38:12 GMT 2003


On Samedi, mars 8, 2003, at 16:27 Europe/Zurich, Daniel Gerald Kluge 
wrote:

>
> On Samedi, mars 8, 2003, at 06:32 Europe/Zurich, Danny wrote:
>>
>> It appears they where hit by a new variant of "MultiDropper" this
>> multidropper has self replicating code which tries to spread via IPC$
>> shares.
>>
>> The McAfee Techs who went out there released an update a little while
>> ago.
>> The info can be found at the following URL.
>>
>> http://vil.nai.com/vil/content/v_100124.htm
>>
>
> That URL doesn't work for me, but the one below seems to be the same 
> issue.
>
> http://vil.mcafee.com/dispVirus.asp?virus_k=100124
>

Sigh, the URL from Danny is correct and works, but yesterday's 
"Security Update" of my squid from Sun/Cobalt rendered my proxy 
unusable for Sites that depend on Host: Headers, by changing the 
configuration in subtle ways.

Thank you Sun/Cobalt for doing this AGAIN to me, I guess it is really 
time to switch from Linux/RPM based toys unto a real Server OS (where 
did I put my OpenBSD CDs)....

-daniel



More information about the list mailing list