nanog mailing list archives
UDP port 4000 traffic: likely a new worm
From: "Johannes B. Ullrich" <jullrich () sans org>
Date: Sat, 20 Mar 2004 03:43:07 -0500
Looks like there may be a worm going around hitting systems that run BlackIce. Common characteristics of the packets: Source port 4000 (but random target port) and the string "insert witty message here". details will be posted here: http://isc.sans.org/diary.html as I get them together. -- CTO SANS Internet Storm Center http://isc.sans.org phone: (617) 837 2807 jullrich () sans org contact details: http://johannes.homepc.org/contact.htm
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- UDP port 4000 traffic: likely a new worm Johannes B. Ullrich (Mar 20)
- Re: UDP port 4000 traffic: likely a new worm Josh Richards (Mar 20)
- Re: UDP port 4000 traffic: likely a new worm Josh Richards (Mar 20)
- Re: UDP port 4000 traffic: likely a new worm George Bakos (Mar 21)
- AW: UDP port 4000 traffic: likely a new worm Florian Frotzler (Mar 22)
- Re: UDP port 4000 traffic: likely a new worm Josh Richards (Mar 20)
- Re: UDP port 4000 traffic: likely a new worm Scott Call (Mar 20)
- Re: UDP port 4000 traffic: likely a new worm Josh Richards (Mar 20)
- <Possible follow-ups>
- Re: UDP port 4000 traffic: likely a new worm Rodney Joffe (Mar 20)