Re: Anybody know what Sobig.F has downloaded?
Dan Stromberg <[email protected]>
| Newsgroups | gmane.comp.security.full-disclosure,gmane.comp.security.incidents,gmane.comp.security.honeypots |
|---|---|
| Message-ID | <[email protected]> |
What if someone cranks a clock forward and sees what the program does? Not having any windows systems at all, I'm in a poor position to try this. :) On Fri, 2003-08-22 at 13:33, Compton, Rich wrote: > As many of you know, the latest Sobig.F virus was scheduled to begin > downloading unknown code from various IPs at 3:00 EST today on UDP port > 8998. Does anybody have any idea what this code is? Are the infected boxes > actually downloading code? Does anybody have an infected Windoze box with > Sobig that can see what code was downloaded? > > Here's a link to some info at Sophos in case you are unfamiliar with this. > > http://www.sophos.com/virusinfo/articles/sobigextra.html > > Looking at the infection rates of this virus, I'd say that it's pretty > important that we find out what this code is and what it does ASAP! > > Thanks, > Rich Compton > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html -- Dan Stromberg DCS/NACS/UCI <[email protected]>
signature.asc
(application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQA/RpVxo0feVm00f/8RAg0SAKCXSem0RSlc4Dau65Sk2Ni3u6bhjwCeLDtA U6DZed6svcvGbTYpdpQsiCM= =Az84 -----END PGP SIGNATURE-----