UDP port 4000 traffic: likely a new worm

Johannes B. Ullrich jullrich at sans.org
Sat Mar 20 08:43:07 UTC 2004


Looks like there may be a worm going around hitting systems that run
BlackIce. Common characteristics of the packets: Source port 4000 (but
random target port) and the string 
"insert witty message here".

details will be posted here:
http://isc.sans.org/diary.html
as I get them together.


-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          jullrich at sans.org 

contact details: http://johannes.homepc.org/contact.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20040320/380cf404/attachment.sig>


More information about the NANOG mailing list