nanog mailing list archives

UDP port 4000 traffic: likely a new worm

From: "Johannes B. Ullrich" <jullrich () sans org>
Date: Sat, 20 Mar 2004 03:43:07 -0500

Looks like there may be a worm going around hitting systems that run
BlackIce. Common characteristics of the packets: Source port 4000 (but
random target port) and the string 
"insert witty message here".

details will be posted here:
http://isc.sans.org/diary.html
as I get them together.


-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          jullrich () sans org 

contact details: http://johannes.homepc.org/contact.htm

Attachment: signature.asc
Description: This is a digitally signed message part

Current thread:

UDP port 4000 traffic: likely a new worm Johannes B. Ullrich (Mar 20)
- Re: UDP port 4000 traffic: likely a new worm Josh Richards (Mar 20)
  - Re: UDP port 4000 traffic: likely a new worm Josh Richards (Mar 20)
    - Re: UDP port 4000 traffic: likely a new worm George Bakos (Mar 21)
    - AW: UDP port 4000 traffic: likely a new worm Florian Frotzler (Mar 22)
  - Re: UDP port 4000 traffic: likely a new worm Scott Call (Mar 20)
- <Possible follow-ups>
- Re: UDP port 4000 traffic: likely a new worm Rodney Joffe (Mar 20)