[Dshield] New worms scanning TCP Port 1025

Blake McNeill mcneillb at linklogger.com
Mon Mar 8 21:58:44 GMT 2004

Two new worms are scanning TCP port 1025 using an RPC Exploit as well as
scanning other ports.  One worm is now called Nachi.F and the other is still
under analysis but will be the topic of a Homeland Security Alert (or at
least from the draft we've seen).  Captures are posted at

Bolt it down kids as it looks like even more fun is on the way.


More information about the list mailing list