funsec mailing list archives

The victims of RPC Trojan Gimmiv were XP boxes in Asia

From: Juha-Matti Laurio <juha-matti.laurio () netti fi>
Date: Fri, 31 Oct 2008 14:23:20 +0200 (EET)

A list of hundreds Windows machines has been released by 0x000000.com recently.
The list entitled RPC Worm Victim List states that the victim machines are mainly Windows XP machines (i.e. MSIE 6.0 or 
MSIE7.0; Windows NT 5.1 in browsers user agent).

I made a script yesterday to generate WHOIS queries and the results say that the victim machines are located mainly in 
Asian area.

There is one machine registered to Microsoft IP too.

Link to my newest SecuriTeam blog entry below:
http://blogs.securiteam.com/index.php/archives/1154

Juha-Matti

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.

Current thread:

The victims of RPC Trojan Gimmiv were XP boxes in Asia Juha-Matti Laurio (Oct 31)
- Re: The victims of RPC Trojan Gimmiv were XP boxes in Asia Alex Eckelberry (Oct 31)