kpatzMY HEAD A SPLODEPremium
join:2003-06-13
Manchester, NH | reply to Link Logger
Re: New Worm scanning on 1025, 2745, 3127 and 6129 When I looked at your port 1025 capture, I saw strings in there that exist in a piece of malware I just dismantled and posted an analysis of in this thread: »nvchip4.exe maybe new virus~~
I wonder if those strings "MARB" and "MEOW" are related to a RPC exploit, or if they are part of that trojan for another reason. |
|
 Link LoggerPremium,MVM
join:2001-03-29
Calgary, AB
kudos:3
 ·Shaw
| Both of those strings also existed in MSBlast (see »www.linklogger.com/msblast.htm ). My 1025 capture is an RPC exploit but is different then MSBlast.
Perhaps 1025 was his infection entry vector.
Blake
--
Vendor: Firewall Logging Software »www.SonicLogger.com - SonicWall and 3Com »www.LinkLogger.com - Linksys, Netgear and Zyxel |
|
kpatzMY HEAD A SPLODEPremium
join:2003-06-13
Manchester, NH | I guess those strings are part of the RPC exploit vector then. Well, time to post another new piece of info in the other thread!  |
|
