RE: CIA Trojan
"lee forrest" <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
My hunch is that he is writing games patches for people and joining his trojan code to the game patch , so not only do you get a game patched but you get a door opened. Looks like the creator is in a transition process , He is testing his program on fast Broadband connections in europe however he is still learning , this is what he asked an expert forum. Please take this with a pinch of salt , as its just a hunch. asked by exxecs on 07/03/2004 10:40AM PDT I use in my app few listening sockets. The sockets are coded in API, like: procedure Listen; var wsadata:twsadata; sockaddrin:tsockaddrin; begin WSAStartUp(257,WSAData); sock:=socket(2,1,0); sockaddrin.sin_family:=AF_INET; sockaddrin.sin_addr.s_addr:=htonl(INADDR_ANY); sockaddrin.sin_port:=htons(port); bind(Sock,sockaddrin,sizeof(sockaddrin)); WSAAsyncSelect(Sock,handle,Msg,FD_ACCEPT or FD_READ or FD_CLOSE); listen(Sock,0); end; When a socket is connected, let say on port 1234, if I look on netstat I see a connection established on port 1234 and also a socket listening on port 1234. I don't understand why the socket is still listening if the connection is established, is that possible? Also, after I close a socket, with closesocket(sock), the listen port is still on the netstat, even if the closesocket returns 0 (no error). So, how can I establish a connection without the remaining listening socket on the netstat? I assume in that way won't be a listening socket after calling closesocket. Thanks. Wonder >From: [email protected] >Reply-To: [email protected] >To: [email protected] >Subject: Intrusions Digest, Vol 5, Issue 53 >Date: Mon, 30 Aug 2004 04:00:12 GMT > >Send Intrusions mailing list submissions to > [email protected] > >To subscribe or unsubscribe via the World Wide Web, visit > http://www.dshield.org/mailman/listinfo/intrusions >or, via email, send a message with subject or body 'help' to > [email protected] > >You can reach the person managing the list at > [email protected] > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of Intrusions digest..." > > >Today's Topics: > > 1. Use Rpcdump for Intrusion detection (lee forrest) > 2. RE: ssh scans with user test, guest , admin > ([email protected]) > 3. RE: How to find a program opening ports on your (Chris Norton) > 4. New Trojan on the block [CIA Trojan] (Chris Norton) > 5. Re: New Trojan on the block [CIA Trojan] (Chris Norton) > 6. Re: New Trojan on the block [CIA Trojan] (Nick FitzGerald) > 7. RE: New SASSER Worm varient ??? (Carey, Steve T GARRISON) > 8. Old archive messages (2nd 1/2 '03)?!? (Stef) > 9. Re: Old archive messages (2nd 1/2 '03)?!? (Stef) > 10. Sudden spate of Messenger "security alerts" (J.D. Baldwin) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Sun, 29 Aug 2004 19:16:14 +0100 >From: "lee forrest" <[email protected]> >Subject: [Intrusions] Use Rpcdump for Intrusion detection >To: [email protected] >Message-ID: <[email protected]> >Content-Type: text/plain; format=flowed > >Just a reminder. > >Netstat -ao shows which PID's are opening ports on your machine however if >you really want to check the rpc end point mapper database , use >RPCDUMP.EXE. >So you can quickly check which servers are registered on your machine or a >target machine and which interfaces. > >_________________________________________________________________ >Express yourself with cool new emoticons >http://www.msn.co.uk/specials/myemo > > > >------------------------------ > >Message: 2 >Date: Sun, 29 Aug 2004 18:12:02 -0400 >From: <[email protected]> >Subject: RE: [Intrusions] ssh scans with user test, guest , admin >To: <[email protected]> >Message-ID: <000001c48e15$368882f0$0201a8c0@netsec> >Content-Type: text/plain; charset="us-ascii" > >I have also seen ssh entries in log files coming from different IPs on >multiple clients. Is an ongoing issue of brute force attacks that have >been happening for the past couple of months. >Read > >http://isc.sans.org/diary.php?date=2004-07-28 >http://isc.sans.org/diary.php?date=2004-08-22 > > > >Date: Sat, 28 Aug 2004 19:36:10 +0200 >From: "cristi stoia" <[email protected]> >Subject: [Intrusions] ssh scans with user test, guest , admin >To: [email protected] >Message-ID: <[email protected]> >Content-Type: text/plain; charset="iso-8859-1" > >hi everyone, >i'm running 5 servers (mail + masq) and starting from last month on >every server i can see ssh scans with user test, guest, admin, and root >from diferent ip-s more than once per day.it looks like a centralized, >automated scan because the time between password tries and user change >is very short, and the scans came at same interval of the day. >enyone seeing this in the logs ? > > > >------------------------------ > >Message: 3 >Date: Sun, 29 Aug 2004 14:43:34 -0500 >From: "Chris Norton" <[email protected]> >Subject: [Intrusions] RE: How to find a program opening ports on your >To: "Intrusions List \(GCIA Practicals\)" <[email protected]> >Message-ID: <[email protected]> >Content-Type: text/plain; charset="iso-8859-1" > >I use a program called TCPView from sysinternals. It is freeware and can be >downloaded at: http://www.sysinternals.com/ntw2k/source/tcpview.shtml >download link is at the very bottom of that page. it is a very nice program >and lists all programs that are listening and the local/remote address and >state. >Don't let the name fool you it also will list UDP ports. > >------------------------------------------------------------- >Chris Norton - UAT Student Software Engineering Network Defense > >------------------------------ > >Message: 4 >Date: Sun, 29 Aug 2004 17:38:15 -0500 >From: "Chris Norton" <[email protected]> >Subject: [Intrusions] New Trojan on the block [CIA Trojan] >To: "Intrusions List \(GCIA Practicals\)" <[email protected]> >Message-ID: <[email protected]> >Content-Type: text/plain; charset="iso-8859-1" > >Ok hopefully my last post and a new snort rule for the new CIA >Trojan/Backdoor 1.23 beta. >Although the readme states that the code is Semi-Polymorhic and that only >7% >of the time is the signature the same but when I looked at 2 .exe files >made by >the main program they were almost the same except for the features added to >the second one to see if it would make a different file. You can use the >following >snort rule to identify if the trojan is being downloaded or uploaded on >your network: > > >alert ip any any -> any any (msg:"Possible CIA Trojan/Backdoor >download/upload attempt"; content:"|6C 75 66 6A 65 6F 6F|"; >classtype:trojan-activity; sid:5000826; rev:1;) > >this string appears in all of the Trojan/Backdoor's and is decoded as: >lufjeoo > >------------------------------------------------------------- >Chris Norton - UAT Student Software Engineering Network Defense > > >------------------------------ > >Message: 5 >Date: Sun, 29 Aug 2004 18:42:12 -0500 >From: "Chris Norton" <[email protected]> >Subject: Re: [Intrusions] New Trojan on the block [CIA Trojan] >To: <[email protected]> >Message-ID: <[email protected]> >Content-Type: text/plain; charset="iso-8859-1" > >[this was edited from the origanl reply sent to Nick for obvious reasons] > >Hello Nick, > >I submitted a Trojan that was found on my machine which was nothing but a >downloader which we still don't know what the purpose of it was. The file I >found on my >machine is in fact caught by AV's. I was refering to the new CIA Trojan >maker. I could have >worded it better yes but it was about 3 AM in the morning lol. What I was >trying to say is I ran >the trojan [Win32/Small.ar] in vmware and monitored what site it was trying >to access which was >213.46.226.xx > >192.168.80.129 213.46.226.xx HTTP GET >/zosman/cia/index.php HTTP/1.1 > >213.46.226.xx 192.168.80.129 HTTP HTTP/1.1 404 Not >Found (text/html) > >So what I did was follow this and googled zosman/cia. >I downloaded the trojan maker and droped it into vmware to >see just what exactly it did. I noticed at first the file size was >way bigger than the one I had on my system: > > CIA 1.23 size: 119kb made in: VB >Win32/Small.ar size: 15kb made in: Delphi by someone named exxecs > >Why he was pointing this at the CIA website >I have no idea and I guess we will never find out. But thats what >made me stumble on to the new Trojan/Backdoor. >Did this clear it up any? > >------------------------------------------------------------- >Chris Norton - UAT Student Software Engineering Network Defense > > >------------------------------ > >Message: 6 >Date: Mon, 30 Aug 2004 11:07:33 +1200 >From: Nick FitzGerald <[email protected]> >Subject: Re: [Intrusions] New Trojan on the block [CIA Trojan] >To: [email protected] >Message-ID: <41330A75.7266.51E9DAEE@localhost> >Content-Type: text/plain; charset=US-ASCII > >Chris Norton wrote: > > > As far as CIA goes thats what the group who coded it is calling it [not > > refering to the government agency] as taken from the readme file CIA >1.23 PB > > 1 ( Public Beta 1 ) ... > >This being but one of dozens of obvious reasons why intelligent anti- >malware folk do not name things as their makers wish... > ><<rest snipped>> > >I'm intrigued that, according to your first post, you "submitted it to >the fine folks at ISC" and later seem surprised/upset/concerned that no >AV detect it yet: > > As of this writing there are no known AV signatures available to > detect this new trojan and there have been over 2,800 downloads... > > ...but the actual client program that infects the machines still > goes by undetected. > >I have no reason to believe the "fine folks at ISC" will not have, >eventually, forwarded samples to their antivirus contacts, but sending >such suspect code to a network traffic reporting group, where malware >research would seem to be at least a secondary priority, is surely >introducing at least one, if not several, unnecessary delays to the >process of getting AV detection for something new and perhaps already >deployed to close to three thousand machines. > >For your future reference, here is my standard list of well-known major >AV developer suspect file submission addresses. Note that nowadays it >is probably advisable to use the submission method listed for >NAI/McAfee for all these addresses (and mention in the accompanying >message body that the .ZIP is encrypted and what the password is). > > Authentium (Command Antivirus) <[email protected]> > Computer Associates (US) <[email protected]> > Computer Associates (Vet/EZ) <[email protected]> > DialogueScience (Dr. Web) <[email protected]> > Eset (NOD32) <[email protected]> > F-Secure Corp. <[email protected]> > Frisk Software (F-PROT) <[email protected]> > Grisoft (AVG) <[email protected]> > H+BEDV (AntiVir, Vexira engine) <[email protected]> > Kaspersky Labs <[email protected]> > Network Associates (McAfee) <[email protected]> > (use a ZIP file with the password 'infected' without the quotes) > Norman (NVC) <[email protected]> > Panda Software <[email protected]> > Sophos Plc. <[email protected]> > Symantec (Norton) <[email protected]> > Trend Micro (PC-cillin) <[email protected]> > (Trend may only accept files from users of its products) > >Most of these addresses are monitored either by 24x365 malware support >and analysis teams, or have distributed processing around the globe >providing (close to) 24x365 coverage. Several have automated code >analysis systems that get the "first look" at submitted files, >classifying them for further attention or simply sending back canned >reports of the "we detect it in the DEF update that should ship at X or >you can download a pre-QA copy at Y". Depending on the nature of the >files you submit, you should get several quite prompt responses, at >some of which you'll have to ignore (e.g. a downloader detection is >pretty meaningless as the target of a downloader is usually considered >to be a non-code variable and ignored by any semi-intelligent detection >of that downloader, so the same downloader can be used multiple times >configured to snag stuff from different URLs and will always be >detected as the same downloader and variant). > > >-- >Nick FitzGerald >Computer Virus Consulting Ltd. >Ph/FAX: +64 3 3529854 > > > >------------------------------ > >Message: 7 >Date: Sun, 29 Aug 2004 14:33:18 -0500 >From: "Carey, Steve T GARRISON" <[email protected]> >Subject: RE: [Intrusions] New SASSER Worm varient ??? >To: "Intrusions List \(GCIA Practicals\)" <[email protected]> >Message-ID: > <2A39B3177D295F4583659FD74E26FE71E021ED@redstone817.ad.redstone.army.mil> > >Content-Type: text/plain; charset="iso-8859-1" > >Actually may not be SASSER. Turns out it is an IRCBOT that takes >advanatage of a vulnerability in LSASS. Don't think it is the same >vulnerability as previous reported by Microsoft, these systems were patched >for that vulnerability and had current anti-virus. I have packet captures >of the overflow, or at least most of it, don't have the packets for the >traffic to port 4445 (my sensor I used to see this is pretty much maxed out >and the data 'rolled' on me). Haven't looked at the systems myself to see >what I can find, will try and do that this week. > >Steve Carey > >________________________________ > >From: [email protected] on behalf of James C Slora Jr >Sent: Fri 8/27/2004 5:01 PM >To: 'Intrusions List (GCIA Practicals)' >Subject: RE: [Intrusions] New SASSER Worm varient ??? > > > >Steve Carey wrote: > > > Anyone seeing a new varient of SASSER using port 4445 as the > > back door port? I have had systems infected that were > > patched (and verified). > >Do you have any captures to share, and do you know how the systems were >infected? > >There is a new Sasser variant listed at Trend Micro, but it does not appear >to match your description. >http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER. >G&VSect=T > >Theirs opens TCP 9996 as the initial shell backdoor and does not appear to >do anything that would nail a patched system. > >_______________________________________________ >Intrusions mailing list >[email protected] >http://www.dshield.org/mailman/listinfo/intrusions > > >------------------------------ > >Message: 8 >Date: Sun, 29 Aug 2004 20:45:04 -0500 >From: Stef <[email protected]> >Subject: [Intrusions] Old archive messages (2nd 1/2 '03)?!? >To: Intrusions List <[email protected]> >Message-ID: <[email protected]> >Content-Type: text/plain; charset=US-ASCII > >I was trying to obtain some information from the archives of this >list, dated sometimes toward the end of 2003. Does anybody know what >happened to this list during 2nd half of '03, and if there is any >other place to retrieve (if any!) messages from that time? > >TIA, >Stef > > >------------------------------ > >Message: 9 >Date: Sun, 29 Aug 2004 20:56:48 -0500 >From: Stef <[email protected]> >Subject: [Intrusions] Re: Old archive messages (2nd 1/2 '03)?!? >To: Intrusions List <[email protected]> >Message-ID: <[email protected]> >Content-Type: text/plain; charset=US-ASCII > >Answering my own question (i.e. look somewhere else than dshield): > >http://cert.uni-stuttgart.de/archive/intrusions/ > > >On Sun, 29 Aug 2004 20:45:04 -0500, Stef <[email protected]> wrote: > > I was trying to obtain some information from the archives of this > > list, dated sometimes toward the end of 2003. Does anybody know what > > happened to this list during 2nd half of '03, and if there is any > > other place to retrieve (if any!) messages from that time? > > > > TIA, > > Stef > > > > >------------------------------ > >Message: 10 >Date: Sun, 29 Aug 2004 21:59:11 -0400 >From: "J.D. Baldwin" <[email protected]> >Subject: [Intrusions] Sudden spate of Messenger "security alerts" >To: [email protected] >Message-ID: <[email protected]> >Content-Type: text/plain; charset=us-ascii > > >I don't think this attack is at all new, but I haven't seen more than >a few of these a day in a long, long time. I suddenly started getting >a whole lot of attempts to open "security alert" Messenger dialog >boxes on a windows host (successfully stopped by a firewall). >Timestamps in the tcpdump output are UTC-4. > >Anyway, as of 1148 EDT Sunday morning, Aug. 29th, I started seeing 4-5 >of these per hour, representing more than an order of magnitude >increase over the historical levels at my net. I'm just curious >whether anyone else saw a sudden surge in this activity today. > >Here are two examples. The others are more of the same. > >11:48:24.516517 I 195.194.36.237.16600 > xxx.yyy.1.2.1026: udp 808 > > 0000 04002800 10000000 00000000 00000000 ..(............. > 0010 00000000 00000000 f8917b5a 00ffd011 ..........{Z.... > 0020 a9b200c0 4fb6e6fc 92b40e58 e4c1d5cf ....O......X.... > 0030 6749ab01 8bddbd15 00000000 01000000 gI.............. > 0040 00000000 0000ffff ffffd802 00000000 ................ > 0050 13000000 00000000 13000000 4d494352 ............MICR > 0060 4f534f46 54204e45 54574f52 4b530000 OSOFT NETWORKS.. > 0070 13000000 00000000 13000000 57494e44 ............WIND > 0080 4f575320 55534552 00000000 8c020000 OWS USER........ > 0090 8c020000 00000000 8c020000 4d696372 ............Micr > 00a0 6f736f66 74205365 63757269 74792042 osoft Security B > 00b0 756c6c65 74696e20 4d533033 2d303433 ulletin MS03-043 > 00c0 0d0a0d0a 42756666 6572204f 76657272 ....Buffer Overr > 00d0 756e2069 6e204d65 7373656e 67657220 un in Messenger > 00e0 53657276 69636520 436f756c 6420416c Service Could Al > 00f0 6c6f7720 436f6465 20457865 63757469 low Code Executi > 0100 6f6e2028 38323830 3335290d 0a0d0a41 on (828035)....A > 0110 66666563 74656420 536f6674 77617265 ffected Software > 0120 3a200d0a 0d0a4d69 63726f73 6f667420 : ....Microsoft > 0130 57696e64 6f777320 4e542057 6f726b73 Windows NT Works > 0140 74617469 6f6e200d 0a4d6963 726f736f tation ..Microso > 0150 66742057 696e646f 7773204e 54205365 ft Windows NT Se > 0160 72766572 20342e30 200d0a4d 6963726f rver 4.0 ..Micro > 0170 736f6674 2057696e 646f7773 20323030 soft Windows 200 > 0180 30202020 0d0a4d69 63726f73 6f667420 0 ..Microsoft > 0190 57696e64 6f777320 58502020 0d0a4d69 Windows XP ..Mi > 01a0 63726f73 6f667420 57696e64 6f777320 crosoft Windows > 01b0 57696e39 38202020 0d0a4d69 63726f73 Win98 ..Micros > 01c0 6f667420 57696e64 6f770000 c9fa3141 oft Window....1A > 01d0 84f50200 f4010000 52030000 16000200 ........R....... > 01e0 000000a0 8e2046ff 000500e5 d74a0800 ..... F......J.. > 01f0 45000344 dc510000 7611ca3b c34c41a2 E..D.Q..v..;.LA. > 0200 xxxxxxxx 59340403 03300000 04002800 .........0....(. > 0210 10000000 00000000 00000000 00000000 ................ > 0220 00000000 f8917b5a 00ffd011 a9b200c0 ......{Z........ > 0230 4fb6e6fc b43c0f22 87127aa4 bf6015fb O....<."..z..`.. > 0240 93dc7664 00000000 01000000 00000000 ..vd............ > 0250 0000ffff ffffd802 00000000 13000000 ................ > 0260 00000000 13000000 4d494352 4f534f46 ........MICROSOF > 0270 54204e45 54574f52 4b530000 13000000 T NETWORKS...... > 0280 00000000 13000000 57494e44 4f575320 ........WINDOWS > 0290 55534552 55534552 00000000 8c020000 USERUSER........ > 02a0 00000000 8c020000 4d696372 6f736f66 ........Microsof > 02b0 74205365 63757269 74792042 756c6c65 t Security Bulle > 02c0 74696e20 4d533033 2d303433 0d0a0d0a tin MS03-043.... > 02d0 42756666 6572204f 76657272 756e2069 Buffer Overrun i > 02e0 6e204d65 7373656e 67657220 53657276 n Messenger Serv > 02f0 69636520 436f756c 6420416c 6c6f7720 ice Could Allow > 0300 436f6465 20457865 63757469 6f6e2028 Code Execution ( > 0310 38323830 3335290d 0a0d0a41 66666563 828035)....Affec > 0320 74656420 536f6674 ted Soft > (ttl 118, id 15439) > 4500 0344 3c4f 0000 7611 867d c3c2 24ed > xxxx xxxx 40d8 0402 0330 0000 0400 2800 > 1000 0000 0000 0000 0000 0000 0000 0000 > 0000 0000 f891 7b5a 00ff d011 a9b2 00c0 > 4fb6 e6fc 92b4 0e58 e4c1 d5cf 6749 ab01 > 8bdd bd15 0000 0000 0100 0000 0000 0000 > 0000 ffff ffff d802 0000 0000 1300 0000 > 0000 0000 1300 0000 4d49 4352 4f53 4f46 > 5420 4e45 5457 4f52 4b53 0000 1300 0000 > 0000 0000 1300 0000 5749 4e44 4f57 5320 > 5553 4552 0000 0000 8c02 0000 8c02 0000 > 0000 0000 8c02 0000 4d69 6372 6f73 6f66 > 7420 5365 6375 7269 7479 2042 756c 6c65 > 7469 6e20 4d53 3033 2d30 3433 0d0a 0d0a > 4275 6666 6572 204f 7665 7272 756e 2069 > 6e20 4d65 7373 656e 6765 7220 5365 7276 > 6963 6520 436f 756c 6420 416c 6c6f 7720 > 436f 6465 2045 7865 6375 7469 6f6e 2028 > 3832 3830 3335 290d 0a0d 0a41 6666 6563 > 7465 6420 536f 6674 7761 7265 3a20 0d0a > 0d0a 4d69 6372 6f73 6f66 7420 5769 6e64 > 6f77 7320 4e54 2057 6f72 6b73 7461 7469 > 6f6e 200d 0a4d 6963 726f 736f 6674 2057 > 696e 646f 7773 204e 5420 5365 7276 6572 > 2034 2e30 200d 0a4d 6963 726f 736f 6674 > 2057 696e 646f 7773 2032 3030 3020 2020 > 0d0a 4d69 6372 6f73 6f66 7420 5769 6e64 > 6f77 7320 5850 2020 0d0a 4d69 6372 6f73 > 6f66 7420 5769 6e64 6f77 7320 5769 6e39 > 3820 2020 0d0a 4d69 6372 6f73 6f66 7420 > 5769 6e64 6f77 >11:48:25.193924 I 195.76.65.162.22836 > xxx.yyy.1.2.1027: udp 808 > > 0000 04002800 10000000 00000000 00000000 ..(............. > 0010 00000000 00000000 f8917b5a 00ffd011 ..........{Z.... > 0020 a9b200c0 4fb6e6fc b43c0f22 87127aa4 ....O....<."..z. > 0030 bf6015fb 93dc7664 00000000 01000000 .`....vd........ > 0040 00000000 0000ffff ffffd802 00000000 ................ > 0050 13000000 00000000 13000000 4d494352 ............MICR > 0060 4f534f46 54204e45 54574f52 4b530000 OSOFT NETWORKS.. > 0070 13000000 00000000 13000000 57494e44 ............WIND > 0080 4f575320 55534552 55534552 00000000 OWS USERUSER.... > 0090 8c020000 00000000 8c020000 4d696372 ............Micr > 00a0 6f736f66 74205365 63757269 74792042 osoft Security B > 00b0 756c6c65 74696e20 4d533033 2d303433 ulletin MS03-043 > 00c0 0d0a0d0a 42756666 6572204f 76657272 ....Buffer Overr > 00d0 756e2069 6e204d65 7373656e 67657220 un in Messenger > 00e0 53657276 69636520 436f756c 6420416c Service Could Al > 00f0 6c6f7720 436f6465 20457865 63757469 low Code Executi > 0100 6f6e2028 38323830 3335290d 0a0d0a41 on (828035)....A > 0110 66666563 74656420 536f6674 77617265 ffected Software > 0120 3a200d0a 0d0a4d69 63726f73 6f667420 : ....Microsoft > 0130 57696e64 6f777320 4e542057 6f726b73 Windows NT Works > 0140 74617469 6f6e200d 0a4d6963 726f736f tation ..Microso > 0150 66742057 696e646f 7773204e 54205365 ft Windows NT Se > 0160 72766572 20342e30 200d0a4d 6963726f rver 4.0 ..Micro > 0170 736f6674 2057696e 646f7773 20323030 soft Windows 200 > 0180 30202020 0d0a4d69 63726f73 6f667420 0 ..Microsoft > 0190 57696e64 6f777320 58502020 0d0a4d69 Windows XP ..Mi > 01a0 63726f73 6f667420 57696e64 6f777320 crosoft Windows > 01b0 57696e39 38202020 0d0a4d69 63726f73 Win98 ..Micros > 01c0 6f667420 57696e64 6f770000 00000000 oft Window...... > 01d0 00000000 00000000 00000000 00000000 ................ > 01e0 ........ > 0320 00000000 00000000 ........ > (ttl 118, id 56401) > 4500 0344 dc51 0000 7611 ca3b c34c 41a2 > xxxx xxxx 5934 0403 0330 0000 0400 2800 > 1000 0000 0000 0000 0000 0000 0000 0000 > 0000 0000 f891 7b5a 00ff d011 a9b2 00c0 > 4fb6 e6fc b43c 0f22 8712 7aa4 bf60 15fb > 93dc 7664 0000 0000 0100 0000 0000 0000 > 0000 ffff ffff d802 0000 0000 1300 0000 > 0000 0000 1300 0000 4d49 4352 4f53 4f46 > 5420 4e45 5457 4f52 4b53 0000 1300 0000 > 0000 0000 1300 0000 5749 4e44 4f57 5320 > 5553 4552 5553 4552 0000 0000 8c02 0000 > 0000 0000 8c02 0000 4d69 6372 6f73 6f66 > 7420 5365 6375 7269 7479 2042 756c 6c65 > 7469 6e20 4d53 3033 2d30 3433 0d0a 0d0a > 4275 6666 6572 204f 7665 7272 756e 2069 > 6e20 4d65 7373 656e 6765 7220 5365 7276 > 6963 6520 436f 756c 6420 416c 6c6f 7720 > 436f 6465 2045 7865 6375 7469 6f6e 2028 > 3832 3830 3335 290d 0a0d 0a41 6666 6563 > 7465 6420 536f 6674 7761 7265 3a20 0d0a > 0d0a 4d69 6372 6f73 6f66 7420 5769 6e64 > 6f77 7320 4e54 2057 6f72 6b73 7461 7469 > 6f6e 200d 0a4d 6963 726f 736f 6674 2057 > 696e 646f 7773 204e 5420 5365 7276 6572 > 2034 2e30 200d 0a4d 6963 726f 736f 6674 > 2057 696e 646f 7773 2032 3030 3020 2020 > 0d0a 4d69 6372 6f73 6f66 7420 5769 6e64 > 6f77 7320 5850 2020 0d0a 4d69 6372 6f73 > 6f66 7420 5769 6e64 6f77 7320 5769 6e39 > 3820 2020 0d0a 4d69 6372 6f73 6f66 7420 > 5769 6e64 6f77 > >-- > _+_ From the catapult of |If anyone disagrees with any statement I make, >I >_|70|___:)=}- J.D. Baldwin |am quite prepared not only to retract it, but >also >\ / [email protected]|to deny under oath that I ever made it. -T. >Lehrer >***~~~~----------------------------------------------------------------------- > > >------------------------------ > >_______________________________________________ >Intrusions mailing list >[email protected] >http://www.dshield.org/mailman/listinfo/intrusions > > >End of Intrusions Digest, Vol 5, Issue 53 >***************************************** _________________________________________________________________ It's fast, it's easy and it's free. Get MSN Messenger today! http://www.msn.co.uk/messenger _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions