AW: [Dshield] Kwang2

Johannes B. Ullrich jullrich at sans.org
Thu Jan 8 19:41:00 GMT 2004


> Anyone else seeing a Kwang2 (17300) spike?

These spikes happen from time to time as some 'crew' thinks it
may be a good idea to scan a certain network for this Virus/Trojan.
As they usually use a bot net to do this, you may have a set
of 100 or so hosts scanning your network (usually university/
cable/dsl ) over and over...




-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          jullrich at sans.org 

contact details: http://johannes.homepc.org/contact.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20040108/cfaf5da0/attachment.bin


More information about the list mailing list