Full Disclosure mailing list archives
RE: Backdoor.Sdbot.N Question
From: "Nick Jacobsen" <nick () ethicsdesign com>
Date: Mon, 8 Sep 2003 17:08:12 -0700
Sounds like you probably got hit with a custom packed/encrypted version of sdbot. Most likely vector of attack was the newish IE <object> tag exploit. Nick J. -----Original Message----- From: James Patterson Wicks Sent: Mon 9/8/2003 1:18 PM To: full-disclosure () lists netsys com Cc: Subject: [Full-Disclosure] Backdoor.Sdbot.N Question Anyone know how Backdoor.Sdbot.N spreads? This morning we had several users pop up with this trojan (or a new variant). These users generated a ton of traffic until their machines were unplugged from the network. There systems have all the markers for the Backdoor.Sdbot.N trojan (registry entries, etc), but was not picked up by the Norton virus scan. In fact, even it you perform a manual scan after the trojan was discovered, it is still not detected in the scan. I would also like to know if this is also an indicator of not having the patch for the Blaster worm. This e-mail is the property of Oxygen Media, LLC. It is intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential, or otherwise protected from disclosure. Distribution or copying of this e-mail or the information contained herein by anyone other than the intended recipient is prohibited. If you have received this e-mail in error, please immediately notify us by sending an e-mail to postmaster () oxygen com and destroy all electronic and paper copies of this e-mail. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
<<winmail.dat>>
Current thread:
- Backdoor.Sdbot.N Question James Patterson Wicks (Sep 08)
- RE: Backdoor.Sdbot.N Question Bojan Zdrnja (Sep 08)
- Re: Backdoor.Sdbot.N Question Nick FitzGerald (Sep 08)
- <Possible follow-ups>
- RE: Backdoor.Sdbot.N Question James Patterson Wicks (Sep 08)
- RE: Backdoor.Sdbot.N Question Jade E. Deane (Sep 08)
- Re: Backdoor.Sdbot.N Question cseagle (Sep 09)
- RE: Backdoor.Sdbot.N Question Nick Jacobsen (Sep 08)
- RE: Backdoor.Sdbot.N Question James Patterson Wicks (Sep 09)