Re: udp and dst port 1026

[Bill McCarty <bmccarty () pt-net net>]

Hi all,

Using a sacrificial PC, I surfed over to the web site mentioned in Cedric's 
packet dump, www.popadstop.com. The web page uses Javascript to obfuscate 
its contents, but invites users to download and install a free tool that 
allegedly blocks pop-up spam <g>. I suspect that the user who downloads the 
tool thereby obtains a Trojan that causes their system to begin sending 
such invitations to others. I spent a few minutes trying to unobfuscate the 
web page, but didn't yet entirely succeed in doing so.

So far, my sacrificial PC has not begun emitting probes. But, it's behind a 
NATing firewall. So, it may not be in communication with the mother ship, 
if indeed one exists.

Cheers,

---------------------------------------------------
Bill McCarty



---------------------------------------------------------------------------
----------------------------------------------------------------------------