Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-Disclosure] New Win32 Worm regsvc32.exe offers rootkit feature

from [Raymond Dijkxhoorn] Network Security [Permanent Link]
Subject: Re: [Full-Disclosure] New Win32 Worm regsvc32.exe offers rootkit features
Date: Tue, 30 Mar 2004 19:04:12 +0200 (CEST) 
Hi!


my girlfriend got a new? worm on her win2k desktop.
The worm is quite aggressive in spreading, netstat -a did not find an
end, i expect it to be a phatbot/agobot4 fork
seems like it invaded on port 1025, i dont know which services were
offerd there, but i saw several connections to port 1025.


Yes it is, there are a zillion variants of this bot. 


definitions via web, and scanned ...
No viruses were found.


We submitted new samples to f-prot yesterday, they are working on those. 
Could you try to scan with clamscan, it detected the ones we found. 


Markus Koetter

please mail me for the binary, im really intrested in a analysis report.


Please do, make it password protected please, then i can compare it with 
the ones we found.

Thanks,
Raymond.
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-Disclosure] Re: systrace silently patches full local bypass vulnerability on Linux, KurruPt - FiLe
Next by Date:  [Full-Disclosure] Problem with customized login pages for Oracle SSO, advisories
Previous by Thread:  [Full-Disclosure] New Win32 Worm regsvc32.exe offers rootkit features, Markus Koetter
Next by Thread:  Re: [Full-Disclosure] New Win32 Worm regsvc32.exe offers rootkit features, Alex
Indexes:  [Date] [Thread] [Top] [All Lists]