full-disclosure - Re: New Variant of the Storm Virus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070228205847.abef8322@mbox.edmaster.it>
Date: Wed, 28 Feb 2007 21:58:47 +0100
From: eflorio <eflorio@...aster.it>
To: "gerald.m.davis" <gerald.m.davis@...izonbusiness.com>, 
	full-disclosure@...ts.grok.org.uk, "'WASC Forum'"
	<websecurity@...appsec.org>
Subject: Re: New Variant of the Storm Virus

The web-component of the new StormWorm variant is distributed by the following domains:
mailfreepostcards.com
postcardsbargain.com
2007postcards.com
ecolorpostcards.com
bestnetpostcards.com
freewebpostcards.com

They all resolve to 209.123.8.198 at the moment.
The remote page could be "funvideo.html", "clip.html" or "winner.html".

More info here:
http://www.symantec.com/enterprise/security_response/weblog/2007/02/mespam_infecting_web_20_with_l.html


EF

----- Original Message -----
From: gerald.m.davis
[mailto:gerald.m.davis@...izonbusiness.com]
To:
full-disclosure@...ts.grok.org.uk, 'WASC Forum'
[mailto:websecurity@...appsec.org]
Sent: Wed, 28 Feb 2007 21:40:49
+0100
Subject: [Full-disclosure] New Variant of the Storm Virus


> Was just reading an article about a new variant or what is believe to be a
> varient of the Storm Virus and am trying to find out more information about
> it in order to put appropriate IP/Domain blocks and counter messures in
> place. 
> 
> Specifically I am looking to determing the Domain(s)and IP address to block
> as well as possible obtaining a copy of the code to reverse engineer.
> 
> If anyone has more information on this I would appreciate the feedback. 
> 
> Article of interest:
> http://www.networkworld.com/news/2007/022707-storm-virus-blogs.html?nlhtsec=
> 0226securityalert3&company=SonicWall
> 
> 
> Thanks,
> Gerry
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/