[Fwd: Re: [Full-Disclosure] Increase probe on UDP port 1026]

[InCisT <InCisT@popsikle.net>]

Brian Eckman wrote:
> (I am responding on behalf of myself, not Paul. I thought it might 
> benefit the list to include a little more info, and I'm not sure if he 
> was planning on replying.)
>
> Nick FitzGerald wrote:
>
> > Paul Dokas <dokas@cs.umn.edu> replied to Nicob:
> >
> >
> > > > I captured some packets and it appears to be (only) a Windows Messenger
> > > > "spam" for a "penis enlargement" product.
[snip]

"Support.com" sends out packets to this port. Most of "Support.com"
installs are done by users who click yes and get some malware installed
for them.

InCisT


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html