Full Disclosure mailing list archives
RE: Bagle worm status + more blocking information
From: David Maynor <dave () 0dayspray com>
Date: Mon, 19 Jan 2004 12:12:45 -0500
No cap yet, I just started seeing the email come in this morning so it shouldn't be long. On Mon, 2004-01-19 at 11:23, Donahue, Pat wrote:
Anyone have a packet capture? -----Original Message----- From: Gadi Evron [mailto:ge () egotistical reprehensible net] Sent: Monday, January 19, 2004 3:45 PM To: bugtraq () securityfocus com; full-disclosure () lists netsys com Subject: [Full-disclosure] Bagle worm status + more blocking information Although some AV firms web pages still call this a "not so serious" threat, the latest checks and cross-checks between vendors which are members of TH-Research (The Trojan Horses Research Mailing List) conclude that this is a serious Outbreak. I believe new threat levels will be posted tomorrow morning, but it is no longer a *possible* outbreak, it is BIG. New information on the worm: Status of the web pages this worm tries to connect to is still unclear. Some vendors report it downloading a certain Trojan, but we see no information on that so far since the web pages status is still unclear, as mentioned. Mcafee also reports it listening on port 6777. The worm tries to connect to the following hacked box: 151.201.0.39. Finally now all AV products "speak" of this worm. Response times for detecting/cleaning/webpages updates were not so good. As I mentioned earlier, Kaspersky and The Cleaner (MooSoft) were the noticeable exceptions. FYI. Gadi Evron. The Trojan Horses Research Mailing List - http://ecompute.org/th-list _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Re: Bagle worm status + more blocking information, (continued)
- Re: Bagle worm status + more blocking information Anders (Jan 19)
- Re: Bagle worm status + more blocking information Paul Tinsley (Jan 20)
- Re: Bagle worm status + more blocking information Sylvain Robitaille (Jan 20)
- Re: Re: Bagle worm status + more blocking information Gadi Evron (Jan 20)
- News from Bagle worm Papp Geza (Jan 26)
- Re: News from Bagle worm Joe Stewart (Jan 26)
- Re: Re: Bagle worm status + more blocking information Gadi Evron (Jan 20)
- Security conferences n30 (Jan 22)
- Re: Security conferences Ben Nelson (Jan 22)
- RE: Security conferences Darkslaker (Jan 22)
- RE: Bagle worm status + more blocking information David Maynor (Jan 19)