Re: SID 32174 BLACKLIST DNS request for known malware domain sr.symcd.com - Osx.Backdoor.iWorm

[Joe Gedeon <joe.gedeon () gmail com>]

We also are showing a large number of false positives for this.  Requests
being made by Windows systems are included.  Every MAC system that we have
checked that has triggered this shows negative results for the infection.

On Wed, Oct 15, 2014 at 7:24 AM, Greg Kay <gkay () netconsult co uk> wrote:

> Hi,
>
> We are getting a large amount of hits for this domain which appears to be
> Symantec owned.  Fairly certain this is a false positive.
>
> * 1:32174 <-> ENABLED <-> BLACKLIST DNS request for known malware domain
> sr.symcd.com - Osx.Backdoor.iWorm (blacklist.rules)
> * 1:32173 <-> ENABLED <-> BLACKLIST DNS request for known malware domain
> s2.symcb.com - Osx.Backdoor.iWorm (blacklist.rules)
>
> IP address is associated with geotrust, thawte and verisign as well.
>
> Have checked the references to virustotal but haven't seen anything there
> suggesting its bad.   Maybe I'm missing something.
> www.virustotal.com/en/domain/s2.symcb.com/information/
> www.virustotal.com/en/domain/sr.symcd.com/information/
>
>
>
> Thanks
>
> Greg Kay
>
>
> =============================================================================
>
> netConsult is the trading name of nMSS Limited.
> Telephone (UK) +44 20 7100 3310
> Telephone (US) +1 646 465 7620
>
> Registered in England and Wales: Company No 4509492, VAT No 802254076
> Registered Office: 19-20 Bourne Court, Southend Road, Woodford Green, IG8
> 8HD
>
> Important Notice:
> This message is for the named recipient(s) use only. It may contain
> confidential, proprietary, or legally privileged information.
> No confidentiality or privilege is waived or lost by any mistransmission.
> If you have received this message by error, please immediately
> notify the sender, delete it and all copies of it from your system,
> destroy any hard copies, and notify postmaster () netconsult co uk.
> If you are not the intended recipient, you must not use, disclose,
> distribute, print, or copy any part of this message directly or indirectly.
> Unless otherwise stated, all quoted prices exclude VAT. Please see our
> Terms & Conditions for further details.
>
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://p.sf.net/sfu/Zoho
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
>
>
> Please visit http://blog.snort.org for the latest news about Snort!



-- 
Registered Linux User # 379282

------------------------------------------------------------------------------
Comprehensive Server Monitoring with Site24x7.
Monitor 10 servers for $9/Month.
Get alerted through email, SMS, voice calls or mobile push notifications.
Take corrective actions from your mobile device.
http://p.sf.net/sfu/Zoho

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!