Re: Web counter in the new Swen/Gibe.F worm

["J. Race" <caferace () well com>]

The counter wasn't necessarily a good indication of infected hosts. Who 
knows what they started it as? Seeing as how it wasn't that hard to 
find, it could have been a low-grade publicity stunt. It could have been 
done in a far more stealthy manner.

-jim

security () smharr4 dnsalias net wrote:

> It's a shame the counter was replaced, this gave us a good idea of how
> many hosts were infected and could reveal real numbers of the rate of
> infection - I'm still recieving these emails, over 100 overnight.
>
> Maybe the admins of vutbr.cz would open their web logs to give us more
> accurate information about the point of origin and rate of spread.
>
> If anyone wants the numbers I collected (I have data from the 18th at
> 13:56 through 4:30am today) I'd be happy to provide them.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html