RE: CIA Trojan

"lee forrest" <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]>
My hunch is that he is writing games patches for people and joining his 
trojan code to the game patch , so not only do you get a game patched but 
you get a door opened.

Looks like the creator is in a transition process ,
He is testing his program on fast Broadband connections in europe however he 
is still learning , this is what he asked an expert forum.

Please take this with a pinch of salt , as its just a hunch.


asked by exxecs on 07/03/2004 10:40AM PDT




I use in my app few listening sockets. The sockets are coded in API, like:

procedure Listen;
var
wsadata:twsadata;
sockaddrin:tsockaddrin;
begin
WSAStartUp(257,WSAData);
sock:=socket(2,1,0);
sockaddrin.sin_family:=AF_INET;
sockaddrin.sin_addr.s_addr:=htonl(INADDR_ANY);
sockaddrin.sin_port:=htons(port);
bind(Sock,sockaddrin,sizeof(sockaddrin));
WSAAsyncSelect(Sock,handle,Msg,FD_ACCEPT or FD_READ or FD_CLOSE);
listen(Sock,0);
end;

When a socket is connected, let say on port 1234, if I look on netstat I see 
a connection established on port 1234 and also a socket listening on port 
1234. I don't understand why the socket is still listening if the connection 
is established, is that possible?
Also, after I close a socket, with closesocket(sock), the listen port is 
still on the netstat, even if the closesocket returns 0 (no error).

So, how can I establish a connection without the remaining listening socket 
on the netstat? I assume in that way won't be a listening socket after 
calling closesocket.

Thanks.

Wonder


>From: [email protected]
>Reply-To: [email protected]
>To: [email protected]
>Subject: Intrusions Digest, Vol 5, Issue 53
>Date: Mon, 30 Aug 2004 04:00:12 GMT
>
>Send Intrusions mailing list submissions to
>	[email protected]
>
>To subscribe or unsubscribe via the World Wide Web, visit
>	http://www.dshield.org/mailman/listinfo/intrusions
>or, via email, send a message with subject or body 'help' to
>	[email protected]
>
>You can reach the person managing the list at
>	[email protected]
>
>When replying, please edit your Subject line so it is more specific
>than "Re: Contents of Intrusions digest..."
>
>
>Today's Topics:
>
>    1. Use Rpcdump for Intrusion detection (lee forrest)
>    2. RE: ssh scans with user test, guest , admin
>       ([email protected])
>    3. RE: How to find a program opening ports on your (Chris Norton)
>    4. New Trojan on the block [CIA Trojan] (Chris Norton)
>    5. Re: New Trojan on the block [CIA Trojan] (Chris Norton)
>    6. Re: New Trojan on the block [CIA Trojan] (Nick FitzGerald)
>    7. RE: New SASSER Worm varient ??? (Carey, Steve T GARRISON)
>    8. Old archive messages (2nd 1/2 '03)?!? (Stef)
>    9. Re: Old archive messages (2nd 1/2 '03)?!? (Stef)
>   10. Sudden spate of Messenger "security alerts" (J.D. Baldwin)
>
>
>----------------------------------------------------------------------
>
>Message: 1
>Date: Sun, 29 Aug 2004 19:16:14 +0100
>From: "lee forrest" <[email protected]>
>Subject: [Intrusions] Use Rpcdump for Intrusion detection
>To: [email protected]
>Message-ID: <[email protected]>
>Content-Type: text/plain; format=flowed
>
>Just a reminder.
>
>Netstat -ao shows which PID's are opening ports on your machine however if
>you really want to check the rpc end point mapper database , use
>RPCDUMP.EXE.
>So you can quickly check which servers are registered on your machine or a
>target machine and which interfaces.
>
>_________________________________________________________________
>Express yourself with cool new emoticons 
>http://www.msn.co.uk/specials/myemo
>
>
>
>------------------------------
>
>Message: 2
>Date: Sun, 29 Aug 2004 18:12:02 -0400
>From: <[email protected]>
>Subject: RE: [Intrusions] ssh scans with user test, guest , admin
>To: <[email protected]>
>Message-ID: <000001c48e15$368882f0$0201a8c0@netsec>
>Content-Type: text/plain;	charset="us-ascii"
>
>I have also seen ssh entries in log files coming from different IPs on
>multiple clients.  Is an ongoing issue of brute force attacks that have
>been happening for the past couple of months.
>Read
>
>http://isc.sans.org/diary.php?date=2004-07-28
>http://isc.sans.org/diary.php?date=2004-08-22
>
>
>
>Date: Sat, 28 Aug 2004 19:36:10 +0200
>From: "cristi stoia" <[email protected]>
>Subject: [Intrusions] ssh scans with user test, guest , admin
>To: [email protected]
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset="iso-8859-1"
>
>hi everyone,
>i'm running 5 servers (mail + masq) and starting from last month on
>every server i can see ssh scans with user test, guest, admin, and root
>from diferent ip-s more than once per day.it looks like a centralized,
>automated scan because the time between password tries and user change
>is very short, and the scans came at same interval of the day.
>enyone seeing this in the logs ?
>
>
>
>------------------------------
>
>Message: 3
>Date: Sun, 29 Aug 2004 14:43:34 -0500
>From: "Chris Norton" <[email protected]>
>Subject: [Intrusions] RE: How to find a program opening ports on your
>To: "Intrusions List \(GCIA Practicals\)" <[email protected]>
>Message-ID: <[email protected]>
>Content-Type: text/plain;	charset="iso-8859-1"
>
>I use a program called TCPView from sysinternals. It is freeware and can be 
>downloaded at: http://www.sysinternals.com/ntw2k/source/tcpview.shtml
>download link is at the very bottom of that page. it is a very nice program
>and lists all programs that are listening and the local/remote address and 
>state.
>Don't let the name fool you it also will list UDP ports.
>
>-------------------------------------------------------------
>Chris Norton - UAT Student Software Engineering Network Defense
>
>------------------------------
>
>Message: 4
>Date: Sun, 29 Aug 2004 17:38:15 -0500
>From: "Chris Norton" <[email protected]>
>Subject: [Intrusions] New Trojan on the block [CIA Trojan]
>To: "Intrusions List \(GCIA Practicals\)" <[email protected]>
>Message-ID: <[email protected]>
>Content-Type: text/plain;	charset="iso-8859-1"
>
>Ok hopefully my last post and a new snort rule for the new CIA 
>Trojan/Backdoor 1.23 beta.
>Although the readme states that the code is Semi-Polymorhic and that only 
>7%
>of the time is the signature the same but when I looked at 2 .exe files 
>made by
>the main program they were almost the same except for the features added to
>the second one to see if it would make a different file. You can use the 
>following
>snort rule to identify if the trojan is being downloaded or uploaded on 
>your network:
>
>
>alert ip any any -> any any (msg:"Possible CIA Trojan/Backdoor 
>download/upload attempt"; content:"|6C 75 66 6A 65 6F 6F|"; 
>classtype:trojan-activity; sid:5000826; rev:1;)
>
>this string appears in all of the Trojan/Backdoor's and is decoded as: 
>lufjeoo
>
>-------------------------------------------------------------
>Chris Norton - UAT Student Software Engineering Network Defense
>
>
>------------------------------
>
>Message: 5
>Date: Sun, 29 Aug 2004 18:42:12 -0500
>From: "Chris Norton" <[email protected]>
>Subject: Re: [Intrusions] New Trojan on the block [CIA Trojan]
>To: <[email protected]>
>Message-ID: <[email protected]>
>Content-Type: text/plain;	charset="iso-8859-1"
>
>[this was edited from the origanl reply sent to Nick for obvious reasons]
>
>Hello Nick,
>
>I submitted a Trojan that was found on my machine which was nothing but a
>downloader which we still don't know what the purpose of it was. The file I
>found on my
>machine is in fact caught by AV's. I was refering to the new CIA Trojan
>maker. I could have
>worded it better yes but it was about 3 AM in the morning lol. What I was
>trying to say is I ran
>the trojan [Win32/Small.ar] in vmware and monitored what site it was trying
>to access which was
>213.46.226.xx
>
>192.168.80.129        213.46.226.xx         HTTP     GET
>/zosman/cia/index.php HTTP/1.1
>
>213.46.226.xx         192.168.80.129        HTTP     HTTP/1.1 404 Not
>Found (text/html)
>
>So what I did was follow this and googled zosman/cia.
>I downloaded the trojan maker and droped it into vmware to
>see just what exactly it did. I noticed at first the file size was
>way bigger than the one I had on my system:
>
>  CIA 1.23 size: 119kb made in: VB
>Win32/Small.ar size: 15kb made in: Delphi by someone named exxecs
>
>Why he was pointing this at the CIA website
>I have no idea and I guess we will never find out. But thats what
>made me stumble on to the new Trojan/Backdoor.
>Did this clear it up any?
>
>-------------------------------------------------------------
>Chris Norton - UAT Student Software Engineering Network Defense
>
>
>------------------------------
>
>Message: 6
>Date: Mon, 30 Aug 2004 11:07:33 +1200
>From: Nick FitzGerald <[email protected]>
>Subject: Re: [Intrusions] New Trojan on the block [CIA Trojan]
>To: [email protected]
>Message-ID: <41330A75.7266.51E9DAEE@localhost>
>Content-Type: text/plain; charset=US-ASCII
>
>Chris Norton wrote:
>
> > As far as CIA goes thats what the group who coded it is calling it [not
> > refering to the government agency] as taken from the readme file CIA 
>1.23 PB
> > 1 ( Public Beta 1 ) ...
>
>This being but one of dozens of obvious reasons why intelligent anti-
>malware folk do not name things as their makers wish...
>
><<rest snipped>>
>
>I'm intrigued that, according to your first post, you "submitted it to
>the fine folks at ISC" and later seem surprised/upset/concerned that no
>AV detect it yet:
>
>    As of this writing there are no known AV signatures available to
>    detect this new trojan and there have been over 2,800 downloads...
>
>    ...but the actual client program that infects the machines still
>    goes by undetected.
>
>I have no reason to believe the "fine folks at ISC" will not have,
>eventually, forwarded samples to their antivirus contacts, but sending
>such suspect code to a network traffic reporting group, where malware
>research would seem to be at least a secondary priority, is surely
>introducing at least one, if not several, unnecessary delays to the
>process of getting AV detection for something new and perhaps already
>deployed to close to three thousand machines.
>
>For your future reference, here is my standard list of well-known major
>AV developer suspect file submission addresses.  Note that nowadays it
>is probably advisable to use the submission method listed for
>NAI/McAfee for all these addresses (and mention in the accompanying
>message body that the .ZIP is encrypted and what the password is).
>
>    Authentium (Command Antivirus)  <[email protected]>
>    Computer Associates (US)        <[email protected]>
>    Computer Associates (Vet/EZ)    <[email protected]>
>    DialogueScience (Dr. Web)       <[email protected]>
>    Eset (NOD32)                    <[email protected]>
>    F-Secure Corp.                  <[email protected]>
>    Frisk Software (F-PROT)         <[email protected]>
>    Grisoft (AVG)                   <[email protected]>
>    H+BEDV (AntiVir, Vexira engine) <[email protected]>
>    Kaspersky Labs                  <[email protected]>
>    Network Associates (McAfee)     <[email protected]>
>      (use a ZIP file with the password 'infected' without the quotes)
>    Norman (NVC)                    <[email protected]>
>    Panda Software                  <[email protected]>
>    Sophos Plc.                     <[email protected]>
>    Symantec (Norton)               <[email protected]>
>    Trend Micro (PC-cillin)         <[email protected]>
>      (Trend may only accept files from users of its products)
>
>Most of these addresses are monitored either by 24x365 malware support
>and analysis teams, or have distributed processing around the globe
>providing (close to) 24x365 coverage.  Several have automated code
>analysis systems that get the "first look" at submitted files,
>classifying them for further attention or simply sending back canned
>reports of the "we detect it in the DEF update that should ship at X or
>you can download a pre-QA copy at Y".  Depending on the nature of the
>files you submit, you should get several quite prompt responses, at
>some of which you'll have to ignore (e.g. a downloader detection is
>pretty meaningless as the target of a downloader is usually considered
>to be a non-code variable and ignored by any semi-intelligent detection
>of that downloader, so the same downloader can be used multiple times
>configured to snag stuff from different URLs and will always be
>detected as the same downloader and variant).
>
>
>--
>Nick FitzGerald
>Computer Virus Consulting Ltd.
>Ph/FAX: +64 3 3529854
>
>
>
>------------------------------
>
>Message: 7
>Date: Sun, 29 Aug 2004 14:33:18 -0500
>From: "Carey, Steve T GARRISON" <[email protected]>
>Subject: RE: [Intrusions] New SASSER Worm varient ???
>To: "Intrusions List \(GCIA Practicals\)" <[email protected]>
>Message-ID:
>	<2A39B3177D295F4583659FD74E26FE71E021ED@redstone817.ad.redstone.army.mil>
>
>Content-Type: text/plain; charset="iso-8859-1"
>
>Actually may not be SASSER.  Turns out it is an IRCBOT that takes 
>advanatage of a vulnerability in LSASS.  Don't think it is the same 
>vulnerability as previous reported by Microsoft, these systems were patched 
>for that vulnerability and had current anti-virus.  I have packet captures 
>of the overflow, or at least most of it, don't have the packets for the 
>traffic to port 4445 (my sensor I used to see this is pretty much maxed out 
>and the data 'rolled' on me).   Haven't looked at the systems myself to see 
>what I can find, will try and do that this week.
>
>Steve Carey
>
>________________________________
>
>From: [email protected] on behalf of James C Slora Jr
>Sent: Fri 8/27/2004 5:01 PM
>To: 'Intrusions List (GCIA Practicals)'
>Subject: RE: [Intrusions] New SASSER Worm varient ???
>
>
>
>Steve Carey wrote:
>
> > Anyone seeing a new varient of SASSER using port 4445 as the
> > back door port?  I have had systems infected that were
> > patched (and verified).
>
>Do you have any captures to share, and do you know how the systems were
>infected?
>
>There is a new Sasser variant listed at Trend Micro, but it does not appear
>to match your description.
>http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.
>G&VSect=T
>
>Theirs opens TCP 9996 as the initial shell backdoor and does not appear to
>do anything that would nail a patched system.
>
>_______________________________________________
>Intrusions mailing list
>[email protected]
>http://www.dshield.org/mailman/listinfo/intrusions
>
>
>------------------------------
>
>Message: 8
>Date: Sun, 29 Aug 2004 20:45:04 -0500
>From: Stef <[email protected]>
>Subject: [Intrusions] Old archive messages (2nd 1/2 '03)?!?
>To: Intrusions List <[email protected]>
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=US-ASCII
>
>I was trying to obtain some information from the archives of this
>list, dated sometimes toward the end of 2003. Does anybody know what
>happened to this list during 2nd half of '03, and if there is any
>other place to retrieve (if any!) messages from that time?
>
>TIA,
>Stef
>
>
>------------------------------
>
>Message: 9
>Date: Sun, 29 Aug 2004 20:56:48 -0500
>From: Stef <[email protected]>
>Subject: [Intrusions] Re: Old archive messages (2nd 1/2 '03)?!?
>To: Intrusions List <[email protected]>
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=US-ASCII
>
>Answering my own question (i.e. look somewhere else than dshield):
>
>http://cert.uni-stuttgart.de/archive/intrusions/
>
>
>On Sun, 29 Aug 2004 20:45:04 -0500, Stef <[email protected]> wrote:
> > I was trying to obtain some information from the archives of this
> > list, dated sometimes toward the end of 2003. Does anybody know what
> > happened to this list during 2nd half of '03, and if there is any
> > other place to retrieve (if any!) messages from that time?
> >
> > TIA,
> > Stef
> >
>
>
>------------------------------
>
>Message: 10
>Date: Sun, 29 Aug 2004 21:59:11 -0400
>From: "J.D. Baldwin" <[email protected]>
>Subject: [Intrusions] Sudden spate of Messenger "security alerts"
>To: [email protected]
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=us-ascii
>
>
>I don't think this attack is at all new, but I haven't seen more than
>a few of these a day in a long, long time.  I suddenly started getting
>a whole lot of attempts to open "security alert" Messenger dialog
>boxes on a windows host (successfully stopped by a firewall).
>Timestamps in the tcpdump output are UTC-4.
>
>Anyway, as of 1148 EDT Sunday morning, Aug. 29th, I started seeing 4-5
>of these per hour, representing more than an order of magnitude
>increase over the historical levels at my net.  I'm just curious
>whether anyone else saw a sudden surge in this activity today.
>
>Here are two examples.  The others are more of the same.
>
>11:48:24.516517 I 195.194.36.237.16600 > xxx.yyy.1.2.1026:  udp 808
>
>     0000 04002800 10000000 00000000 00000000 ..(.............
>     0010 00000000 00000000 f8917b5a 00ffd011 ..........{Z....
>     0020 a9b200c0 4fb6e6fc 92b40e58 e4c1d5cf ....O......X....
>     0030 6749ab01 8bddbd15 00000000 01000000 gI..............
>     0040 00000000 0000ffff ffffd802 00000000 ................
>     0050 13000000 00000000 13000000 4d494352 ............MICR
>     0060 4f534f46 54204e45 54574f52 4b530000 OSOFT NETWORKS..
>     0070 13000000 00000000 13000000 57494e44 ............WIND
>     0080 4f575320 55534552 00000000 8c020000 OWS USER........
>     0090 8c020000 00000000 8c020000 4d696372 ............Micr
>     00a0 6f736f66 74205365 63757269 74792042 osoft Security B
>     00b0 756c6c65 74696e20 4d533033 2d303433 ulletin MS03-043
>     00c0 0d0a0d0a 42756666 6572204f 76657272 ....Buffer Overr
>     00d0 756e2069 6e204d65 7373656e 67657220 un in Messenger
>     00e0 53657276 69636520 436f756c 6420416c Service Could Al
>     00f0 6c6f7720 436f6465 20457865 63757469 low Code Executi
>     0100 6f6e2028 38323830 3335290d 0a0d0a41 on (828035)....A
>     0110 66666563 74656420 536f6674 77617265 ffected Software
>     0120 3a200d0a 0d0a4d69 63726f73 6f667420 : ....Microsoft
>     0130 57696e64 6f777320 4e542057 6f726b73 Windows NT Works
>     0140 74617469 6f6e200d 0a4d6963 726f736f tation ..Microso
>     0150 66742057 696e646f 7773204e 54205365 ft Windows NT Se
>     0160 72766572 20342e30 200d0a4d 6963726f rver 4.0 ..Micro
>     0170 736f6674 2057696e 646f7773 20323030 soft Windows 200
>     0180 30202020 0d0a4d69 63726f73 6f667420 0   ..Microsoft
>     0190 57696e64 6f777320 58502020 0d0a4d69 Windows XP  ..Mi
>     01a0 63726f73 6f667420 57696e64 6f777320 crosoft Windows
>     01b0 57696e39 38202020 0d0a4d69 63726f73 Win98   ..Micros
>     01c0 6f667420 57696e64 6f770000 c9fa3141 oft Window....1A
>     01d0 84f50200 f4010000 52030000 16000200 ........R.......
>     01e0 000000a0 8e2046ff 000500e5 d74a0800 ..... F......J..
>     01f0 45000344 dc510000 7611ca3b c34c41a2 E..D.Q..v..;.LA.
>     0200 xxxxxxxx 59340403 03300000 04002800 .........0....(.
>     0210 10000000 00000000 00000000 00000000 ................
>     0220 00000000 f8917b5a 00ffd011 a9b200c0 ......{Z........
>     0230 4fb6e6fc b43c0f22 87127aa4 bf6015fb O....<."..z..`..
>     0240 93dc7664 00000000 01000000 00000000 ..vd............
>     0250 0000ffff ffffd802 00000000 13000000 ................
>     0260 00000000 13000000 4d494352 4f534f46 ........MICROSOF
>     0270 54204e45 54574f52 4b530000 13000000 T NETWORKS......
>     0280 00000000 13000000 57494e44 4f575320 ........WINDOWS
>     0290 55534552 55534552 00000000 8c020000 USERUSER........
>     02a0 00000000 8c020000 4d696372 6f736f66 ........Microsof
>     02b0 74205365 63757269 74792042 756c6c65 t Security Bulle
>     02c0 74696e20 4d533033 2d303433 0d0a0d0a tin MS03-043....
>     02d0 42756666 6572204f 76657272 756e2069 Buffer Overrun i
>     02e0 6e204d65 7373656e 67657220 53657276 n Messenger Serv
>     02f0 69636520 436f756c 6420416c 6c6f7720 ice Could Allow
>     0300 436f6465 20457865 63757469 6f6e2028 Code Execution (
>     0310 38323830 3335290d 0a0d0a41 66666563 828035)....Affec
>     0320 74656420 536f6674                   ted Soft
>  (ttl 118, id 15439)
>                          4500 0344 3c4f 0000 7611 867d c3c2 24ed
>                          xxxx xxxx 40d8 0402 0330 0000 0400 2800
>                          1000 0000 0000 0000 0000 0000 0000 0000
>                          0000 0000 f891 7b5a 00ff d011 a9b2 00c0
>                          4fb6 e6fc 92b4 0e58 e4c1 d5cf 6749 ab01
>                          8bdd bd15 0000 0000 0100 0000 0000 0000
>                          0000 ffff ffff d802 0000 0000 1300 0000
>                          0000 0000 1300 0000 4d49 4352 4f53 4f46
>                          5420 4e45 5457 4f52 4b53 0000 1300 0000
>                          0000 0000 1300 0000 5749 4e44 4f57 5320
>                          5553 4552 0000 0000 8c02 0000 8c02 0000
>                          0000 0000 8c02 0000 4d69 6372 6f73 6f66
>                          7420 5365 6375 7269 7479 2042 756c 6c65
>                          7469 6e20 4d53 3033 2d30 3433 0d0a 0d0a
>                          4275 6666 6572 204f 7665 7272 756e 2069
>                          6e20 4d65 7373 656e 6765 7220 5365 7276
>                          6963 6520 436f 756c 6420 416c 6c6f 7720
>                          436f 6465 2045 7865 6375 7469 6f6e 2028
>                          3832 3830 3335 290d 0a0d 0a41 6666 6563
>                          7465 6420 536f 6674 7761 7265 3a20 0d0a
>                          0d0a 4d69 6372 6f73 6f66 7420 5769 6e64
>                          6f77 7320 4e54 2057 6f72 6b73 7461 7469
>                          6f6e 200d 0a4d 6963 726f 736f 6674 2057
>                          696e 646f 7773 204e 5420 5365 7276 6572
>                          2034 2e30 200d 0a4d 6963 726f 736f 6674
>                          2057 696e 646f 7773 2032 3030 3020 2020
>                          0d0a 4d69 6372 6f73 6f66 7420 5769 6e64
>                          6f77 7320 5850 2020 0d0a 4d69 6372 6f73
>                          6f66 7420 5769 6e64 6f77 7320 5769 6e39
>                          3820 2020 0d0a 4d69 6372 6f73 6f66 7420
>                          5769 6e64 6f77
>11:48:25.193924 I 195.76.65.162.22836 > xxx.yyy.1.2.1027:  udp 808
>
>     0000 04002800 10000000 00000000 00000000 ..(.............
>     0010 00000000 00000000 f8917b5a 00ffd011 ..........{Z....
>     0020 a9b200c0 4fb6e6fc b43c0f22 87127aa4 ....O....<."..z.
>     0030 bf6015fb 93dc7664 00000000 01000000 .`....vd........
>     0040 00000000 0000ffff ffffd802 00000000 ................
>     0050 13000000 00000000 13000000 4d494352 ............MICR
>     0060 4f534f46 54204e45 54574f52 4b530000 OSOFT NETWORKS..
>     0070 13000000 00000000 13000000 57494e44 ............WIND
>     0080 4f575320 55534552 55534552 00000000 OWS USERUSER....
>     0090 8c020000 00000000 8c020000 4d696372 ............Micr
>     00a0 6f736f66 74205365 63757269 74792042 osoft Security B
>     00b0 756c6c65 74696e20 4d533033 2d303433 ulletin MS03-043
>     00c0 0d0a0d0a 42756666 6572204f 76657272 ....Buffer Overr
>     00d0 756e2069 6e204d65 7373656e 67657220 un in Messenger
>     00e0 53657276 69636520 436f756c 6420416c Service Could Al
>     00f0 6c6f7720 436f6465 20457865 63757469 low Code Executi
>     0100 6f6e2028 38323830 3335290d 0a0d0a41 on (828035)....A
>     0110 66666563 74656420 536f6674 77617265 ffected Software
>     0120 3a200d0a 0d0a4d69 63726f73 6f667420 : ....Microsoft
>     0130 57696e64 6f777320 4e542057 6f726b73 Windows NT Works
>     0140 74617469 6f6e200d 0a4d6963 726f736f tation ..Microso
>     0150 66742057 696e646f 7773204e 54205365 ft Windows NT Se
>     0160 72766572 20342e30 200d0a4d 6963726f rver 4.0 ..Micro
>     0170 736f6674 2057696e 646f7773 20323030 soft Windows 200
>     0180 30202020 0d0a4d69 63726f73 6f667420 0   ..Microsoft
>     0190 57696e64 6f777320 58502020 0d0a4d69 Windows XP  ..Mi
>     01a0 63726f73 6f667420 57696e64 6f777320 crosoft Windows
>     01b0 57696e39 38202020 0d0a4d69 63726f73 Win98   ..Micros
>     01c0 6f667420 57696e64 6f770000 00000000 oft Window......
>     01d0 00000000 00000000 00000000 00000000 ................
>     01e0 ........
>     0320 00000000 00000000                   ........
>  (ttl 118, id 56401)
>                          4500 0344 dc51 0000 7611 ca3b c34c 41a2
>                          xxxx xxxx 5934 0403 0330 0000 0400 2800
>                          1000 0000 0000 0000 0000 0000 0000 0000
>                          0000 0000 f891 7b5a 00ff d011 a9b2 00c0
>                          4fb6 e6fc b43c 0f22 8712 7aa4 bf60 15fb
>                          93dc 7664 0000 0000 0100 0000 0000 0000
>                          0000 ffff ffff d802 0000 0000 1300 0000
>                          0000 0000 1300 0000 4d49 4352 4f53 4f46
>                          5420 4e45 5457 4f52 4b53 0000 1300 0000
>                          0000 0000 1300 0000 5749 4e44 4f57 5320
>                          5553 4552 5553 4552 0000 0000 8c02 0000
>                          0000 0000 8c02 0000 4d69 6372 6f73 6f66
>                          7420 5365 6375 7269 7479 2042 756c 6c65
>                          7469 6e20 4d53 3033 2d30 3433 0d0a 0d0a
>                          4275 6666 6572 204f 7665 7272 756e 2069
>                          6e20 4d65 7373 656e 6765 7220 5365 7276
>                          6963 6520 436f 756c 6420 416c 6c6f 7720
>                          436f 6465 2045 7865 6375 7469 6f6e 2028
>                          3832 3830 3335 290d 0a0d 0a41 6666 6563
>                          7465 6420 536f 6674 7761 7265 3a20 0d0a
>                          0d0a 4d69 6372 6f73 6f66 7420 5769 6e64
>                          6f77 7320 4e54 2057 6f72 6b73 7461 7469
>                          6f6e 200d 0a4d 6963 726f 736f 6674 2057
>                          696e 646f 7773 204e 5420 5365 7276 6572
>                          2034 2e30 200d 0a4d 6963 726f 736f 6674
>                          2057 696e 646f 7773 2032 3030 3020 2020
>                          0d0a 4d69 6372 6f73 6f66 7420 5769 6e64
>                          6f77 7320 5850 2020 0d0a 4d69 6372 6f73
>                          6f66 7420 5769 6e64 6f77 7320 5769 6e39
>                          3820 2020 0d0a 4d69 6372 6f73 6f66 7420
>                          5769 6e64 6f77
>
>--
>   _+_ From the catapult of |If anyone disagrees with any statement I make, 
>I
>_|70|___:)=}- J.D. Baldwin |am quite prepared not only to retract it, but 
>also
>\      /  [email protected]|to deny under oath that I ever made it. -T. 
>Lehrer
>***~~~~-----------------------------------------------------------------------
>
>
>------------------------------
>
>_______________________________________________
>Intrusions mailing list
>[email protected]
>http://www.dshield.org/mailman/listinfo/intrusions
>
>
>End of Intrusions Digest, Vol 5, Issue 53
>*****************************************

_________________________________________________________________
It's fast, it's easy and it's free. Get MSN Messenger today! 
http://www.msn.co.uk/messenger

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.