full-disclosure - New Worm in the wild

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: r1an at hush.ai (r1an)
Subject: New Worm in the wild

The ICMP traffic is probably Nachi/Welchia/Blaster.D.  As for the email
attachments, take your pick. We have several daily specials: Sobig.F
is very popular, the Yaha.P is fresh, and the kids love Dumaru.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.D
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SOBIG.F
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_YAHA.P
http://securityresponse.symantec.com/avcenter/venc/data/w32.dumaru@mm.html

On Tue, 19 Aug 2003 07:30:17 -0700 dbtrino2@...h.com wrote:
>we see a lot of ping traffic and have a lot of users who report
>of mails with attachements ~74KB which have not been send by the 'sender'.
Anyone can confirm this?