Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: New Win32 Worm regsvc32.exe offers rootkit features
From: Raymond Dijkxhoorn <raymond () prolocation net>
Date: Tue, 30 Mar 2004 19:04:12 +0200 (CEST)


my girlfriend got a new? worm on her win2k desktop.
The worm is quite aggressive in spreading, netstat -a did not find an
end, i expect it to be a phatbot/agobot4 fork
seems like it invaded on port 1025, i dont know which services were
offerd there, but i saw several connections to port 1025.

Yes it is, there are a zillion variants of this bot. 

definitions via web, and scanned ...
No viruses were found.

We submitted new samples to f-prot yesterday, they are working on those. 
Could you try to scan with clamscan, it detected the ones we found. 

Markus Koetter

please mail me for the binary, im really intrested in a analysis report.

Please do, make it password protected please, then i can compare it with 
the ones we found.


Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]