[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-Disclosure] New Worm in the wild 

The ICMP traffic is probably Nachi/Welchia/Blaster.D.  As for the email
attachments, take your pick. We have several daily specials: Sobig.F
is very popular, the Yaha.P is fresh, and the kids love Dumaru.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.D
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBIG.F
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_YAHA.P
http://securityresponse.symantec.com/avcenter/venc/data/w32.dumaru@mm.html

On Tue, 19 Aug 2003 07:30:17 -0700 dbtrino2@hush.com wrote:
>we see a lot of ping traffic and have a lot of users who report
>of mails with attachements ~74KB which have not been send by the 'sender'.
Anyone can confirm this?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html