[Dshield] Swen Virus

George Theall theall at tifaware.com
Fri Sep 19 17:09:18 GMT 2003


On Fri, Sep 19, 2003 at 12:32:45PM -0400, Paul Marsh wrote:
> It is said that once the virus has executed it does the following.
> 
> Sends an HTTP Get request to a predefined HTTP server to retrieve
> counter information when the worm runs for the first time.  Then, the
> worm may display the counter information. 
> 
> Does anyone know the address of the web site in question, it might be
> a good tool to see how many infections there are. 

I believe it used to be:

  http://ww2.fce.vutbr.cz/bin/counter.gif/link=bacillus&width=6&set=cnt006

When I looked at it last night around 9 pm (EDT), I recall it reading 1+
million, and increasing by 100 or so as quickly as I could reload it. 
Now, though, it's displaying a GIF saying you've been infected with the
virus. 

George
-- 
theall at tifaware.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/list/attachments/20030919/9c3338ba/attachment.bin


More information about the list mailing list