[unisog] any one seeing an increase in 17300 SYN

Harris, Michael C. HarrisMC at health.missouri.edu
Wed Feb 12 15:56:10 GMT 2003


I assume others of you are seeing a recent upswing in what we assume is Kuang2 (SYN 17300) in the last  48 hours? 
We are seeing a odd increase at midnight 00:00 cst on 02/11/03  and 01:13 cst on 02/12/03 only.  
Is there something in this virus controlling the timing? or is someone trolling for infected machines?  I've never looked at a live copy or the code itself for Kuang2.

notice the heavy upswing in sources beginning on the 5th...
http://isc.incidents.org/port_details.html?port=17300

anyone done much investigation other than writing it off as KUANG2?

Mike


--------------------------------------------------
Michael C Harris
System Security Analyst - GSEC
ITS / Research Education and Support
University of Missouri Health Center
Phone: 573-882-3392 

harrismc at health.missouri.edu
--------------------------------------------------
no Kuang2 is not a town in France...




More information about the unisog mailing list