full-disclosure - Re: Secure.dcom.exe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: wcc at techmonkeys.org (Wcc)
Subject: Re: Secure.dcom.exe

> opticfiber wrote:
> 
> > On a chance I connected to the irc server 
> mentioned.(irc.homelien.no). 
> > Did a channel search for "rpc" and found a channel called 
> "#rpcfucked" 
> > with a contant stream of clients connecting and 
> disconnecting. Below 
> > is a transcript of the channel for about five minutes or so.

They all appear to be on either eatel.net or arcor-ip.net's networks. This
would lead me to believe that this worm infects via it's own network and not
by finding random ip's.

Will Buckner (Wcc)