Re: [Unusual Network_scan[tcp-6267]]

[Patrick Benson <benson () chello se>]

Russell Fulton wrote:
> Anyone have any idea what this might be looking for?  I ususally assume
> that scans on odd port numbers are just looking for hosts compromised in
> previous sweeps but 6267 is a bit too close to 6112 and I want to be
> sure that it isn't another rpc service I don't know about.  I have
> searched the snort port database and google but found nothing relevant.
>
> Cheers, Russell.

Maybe it's looking for this:

http://www.megasecurity.org/trojans/guangwaigirl/Guangwaigirl1.0a.html


-- 
Patrick Benson
Stockholm, Sweden

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com