Full Disclosure mailing list archives
Re: New Variant of the Storm Virus
From: eflorio <eflorio () edmaster it>
Date: Wed, 28 Feb 2007 21:58:47 +0100
The web-component of the new StormWorm variant is distributed by the following domains: mailfreepostcards.com postcardsbargain.com 2007postcards.com ecolorpostcards.com bestnetpostcards.com freewebpostcards.com They all resolve to 209.123.8.198 at the moment. The remote page could be "funvideo.html", "clip.html" or "winner.html". More info here: http://www.symantec.com/enterprise/security_response/weblog/2007/02/mespam_infecting_web_20_with_l.html EF ----- Original Message ----- From: gerald.m.davis [mailto:gerald.m.davis () verizonbusiness com] To: full-disclosure () lists grok org uk, 'WASC Forum' [mailto:websecurity () webappsec org] Sent: Wed, 28 Feb 2007 21:40:49 +0100 Subject: [Full-disclosure] New Variant of the Storm Virus
Was just reading an article about a new variant or what is believe to be a varient of the Storm Virus and am trying to find out more information about it in order to put appropriate IP/Domain blocks and counter messures in place. Specifically I am looking to determing the Domain(s)and IP address to block as well as possible obtaining a copy of the code to reverse engineer. If anyone has more information on this I would appreciate the feedback. Article of interest: http://www.networkworld.com/news/2007/022707-storm-virus-blogs.html?nlhtsec= 0226securityalert3&company=SonicWall Thanks, Gerry _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: New Variant of the Storm Virus eflorio (Feb 28)