[Dshield] New worms scanning TCP Port 1025

Blake McNeill mcneillb at linklogger.com
Mon Mar 8 21:58:44 GMT 2004


Two new worms are scanning TCP port 1025 using an RPC Exploit as well as
scanning other ports.  One worm is now called Nachi.F and the other is still
under analysis but will be the topic of a Homeland Security Alert (or at
least from the draft we've seen).  Captures are posted at
http://www.linklogger.com/Port1025_RPC_Exploit.htm

Bolt it down kids as it looks like even more fun is on the way.

Blake




More information about the list mailing list