Full Disclosure mailing list archives
Re: New Win32 Worm regsvc32.exe offers rootkit features
From: Raymond Dijkxhoorn <raymond () prolocation net>
Date: Tue, 30 Mar 2004 19:04:12 +0200 (CEST)
Hi!
my girlfriend got a new? worm on her win2k desktop. The worm is quite aggressive in spreading, netstat -a did not find an end, i expect it to be a phatbot/agobot4 fork seems like it invaded on port 1025, i dont know which services were offerd there, but i saw several connections to port 1025.
Yes it is, there are a zillion variants of this bot.
definitions via web, and scanned ... No viruses were found.
We submitted new samples to f-prot yesterday, they are working on those. Could you try to scan with clamscan, it detected the ones we found.
Markus Koetter please mail me for the binary, im really intrested in a analysis report.
Please do, make it password protected please, then i can compare it with the ones we found. Thanks, Raymond. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- New Win32 Worm regsvc32.exe offers rootkit features Markus Koetter (Mar 30)
- Re: New Win32 Worm regsvc32.exe offers rootkit features Raymond Dijkxhoorn (Mar 30)
- Re: New Win32 Worm regsvc32.exe offers rootkit features Alex (Mar 30)
- RE: New Win32 Worm regsvc32.exe offers rootkit features Aditya, ALD [Aditya Lalit Deshmukh] (Mar 30)
- Re: New Win32 Worm regsvc32.exe offers rootkit features Elia Florio (Mar 30)
- Re: New Win32 Worm regsvc32.exe offers rootkit features Raymond Dijkxhoorn (Mar 30)
- Re: New Win32 Worm regsvc32.exe offers rootkit features K.Seyhan (Mar 30)
- Re: New Win32 Worm regsvc32.exe offers rootkit features Markus Koetter (Mar 31)
- Security Hole in HTTP (RFC1945) - Browser-Spoofing Ron Stiemer (Mar 31)
- Re: New Win32 Worm regsvc32.exe offers rootkit features Markus Koetter (Mar 31)