Re: Bagle worm status + more blocking information

[Paul Tinsley <pdt () jackhammer org>]

Do we know if it respects system proxy settings or attempts direct port 
80 access to the websites mentioned by the A/V vendors?

Gadi Evron wrote:

> Although some AV firms web pages still call this a "not so serious" 
> threat, the latest checks and cross-checks between vendors which are 
> members of TH-Research (The Trojan Horses Research Mailing List) 
> conclude that this is a serious Outbreak.
>
> I believe new threat levels will be posted tomorrow morning, but it is
> no longer a *possible* outbreak, it is BIG.
>
>
> New information on the worm:
>
> Status of the web pages this worm tries to connect to is still unclear.
>
> Some vendors report it downloading a certain Trojan, but we see no 
> information on that so far since the web pages status is still 
> unclear, as mentioned.
>
> Mcafee also reports it listening on port 6777.
>
> The worm tries to connect to the following hacked box: 151.201.0.39.
>
> Finally now all AV products "speak" of this worm.
> Response times for detecting/cleaning/webpages updates were not so good.
>
> As I mentioned earlier, Kaspersky and The Cleaner (MooSoft) were the 
> noticeable exceptions.
>
> FYI.
>
>     Gadi Evron.
>
> The Trojan Horses Research Mailing List - http://ecompute.org/th-list
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html