Re: Sasser Worm exploiting MS04-011 vulnerabilities

Article View: be.comp.security

Article #934

#934

From: Filbert
Date: Sun, 02 May 2004 07:12

19 lines
1543 bytes

Filbert wrote:

> http://secunia.com/virus_information/9142/sasser/
> http://www.sophos.com/virusinfo/articles/sasser.html
> 
> Ik zie momenteel reeds verschillende probes per minuut op TCP/445 van
> besmette machines.
> 
> 

de snort signature:

alert tcp any any -> $HOME_NET 9996 ( msg: "Sasser Transfer
up.exe";content:"|5F75702E657865|"; depth: 250; flags: A+; classtype:
misc-activity; sid: 1000000; rev: 1;)

-- 
echo "+++ATH0filb@+++ATH0linuxmail.org" | sed 's/+++ATH0//g'
 "Entropy just isn't what it used to be."

Technical Details

Message-ID: <3315139.Yo0TS7TmMl@127.0.0.1>

Path:

arc1-ca.pugleaf.net!controlnews3.google.com!news1.google.com!news.glorb.com!transit.nntp.hccnet.nl!newsfeeder.wxs.nl!aotearoa.belnet.be!news.belnet.be!ossa.telenet-ops.be!phobos.telenet-ops.be.POSTED!not-for-mail

References: <10033547.yWgGLQC1Ax@127.0.0.1>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 113446,bf061752b2fb928f
X-Google-Attributes: gid113446,public
Path: arc1-ca.pugleaf.net!controlnews3.google.com!news1.google.com!news.glorb.com!transit.nntp.hccnet.nl!newsfeeder.wxs.nl!aotearoa.belnet.be!news.belnet.be!ossa.telenet-ops.be!phobos.telenet-ops.be.POSTED!not-for-mail
Message-ID: <3315139.Yo0TS7TmMl@127.0.0.1>
From: Filbert <filbert@spam.la>
Subject: Re: Sasser Worm exploiting MS04-011 vulnerabilities
Newsgroups: be.comp.security
Reply-To: +++ATH0filb@+++ATH0linuxmail.org
References: <10033547.yWgGLQC1Ax@127.0.0.1>
Lines: 19
Organization: .
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7Bit
X-No-Archive: yes
X-Newsreader: nc [v1.10]
Date: Sun, 02 May 2004 07:12:31 GMT
NNTP-Posting-Host: 213.224.229.240
X-Complaints-To: abuse@telenet.be
X-Trace: phobos.telenet-ops.be 1083481951 213.224.229.240 (Sun, 02 May 2004 09:12:31 MEST)
NNTP-Posting-Date: Sun, 02 May 2004 09:12:31 MEST

Reply to Parent Message