[Fwd: Fwd: UDP port 4000 traffic: likely a new worm]

FYI

-----Original Message-----
From: Johannes B. Ullrich [mailto:jullrich@sans.org]
Sent: Saturday, March 20, 2004 08:43 AM
To: nanog@merit.edu
Subject: UDP port 4000 traffic: likely a new worm

Looks like there may be a worm going around hitting systems that run
BlackIce. Common characteristics of the packets: Source port 4000 (but
random target port) and the string
"insert witty message here".

details will be posted here:
http://isc.sans.org/diary.html
as I get them together.

---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
Received on Sat Mar 20 00:08:39 2004