RE: [Full-Disclosure] Re: Secure.dcom.exe

["Wcc" <wcc@techmonkeys.org>]

> opticfiber wrote:
> 
> > On a chance I connected to the irc server 
> mentioned.(irc.homelien.no). 
> > Did a channel search for "rpc" and found a channel called 
> "#rpcfucked" 
> > with a contant stream of clients connecting and 
> disconnecting. Below 
> > is a transcript of the channel for about five minutes or so.

They all appear to be on either eatel.net or arcor-ip.net's networks. This
would lead me to believe that this worm infects via it's own network and not
by finding random ip's.

Will Buckner (Wcc)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html