[unisog] worm that looks for 139, 1433 and 2967

C. Hamby fixer at gci.net
Sat Feb 17 20:01:43 GMT 2007


Sounds like it could be one of the endless
Agobot/Phatbox/xbot-of-the-week variants.  Have you managed to recover
any specimens?

-cdh

power less wrote:
> I noticed a bunch of hosts on our campus were infected yesterday with
> something
> which caused them to scan for 139,1433 and 2967. Anyone else see that?
> Anyone have any info?
> seems to me the previous round of malware that included 2967 also looked
> for 5900
> so this could be somewhat different?
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> unisog mailing list
> unisog at lists.dshield.org
> https://lists.sans.org/mailman/listinfo/unisog



More information about the unisog mailing list