Re: FW: SANS FLASH: New Trojan Sending Data To Russia

[Gary Flynn <flynngn () JMU EDU>]

Appears to be a site scanning for proxy servers that has now been taken
off the net.

http://www.sans.org/y2k/073000.htm
http://www.sans.org/y2k/073100-1030.htm

Ed Padin wrote:
> Can anyone shed more light on this?
>
> -----Original Message-----
> From: The SANS Institute [mailto:sans () sans org]
> Sent: Friday, July 28, 2000 8:35 PM
> Subject: SANS FLASH: New Trojan Sending Data To Russia
>
> SANS Flash Report: Trojans Sending More Data To Russia
> July 28, 2000, 6:20 pm, EDT
>
> This is preliminary information.  The GIAC (Global Incident
> Analysis Center) has received several submissions showing large
> amounts of data being sent, illegitimately, from Windows 98
> machines to a Russian IP address (194.87.6.X).  The cause is most
> probably a Trojan, but whatever it is, it is moving fast.