Re: Sasser or other nasty worm needed

[Michael Holstein <michael.holstein () csuohio edu>]

> Does anyone have a copy of Sasser or a similar worm that they would be
> willing to send or link me to?  Please contact me off-list.  I would be
> happy to verify my identity as a high school teacher off-list as I'm sure
> that is a concern for most anyone who has what I am looking for.  

You're kidding, right? .. just take a fresh install of Win2K and hook it 
to the Internet.

Go get coffee. Come back in ~15min.

Boot to BartPE (or Knoppix, etc) and look for anything new in 
%systemroot%. You'll probably have more than one. It'll be a binary 
though, probably packed/encrypted 3+ times (and that's annoying, but not 
impossible, to reverse-engineer).

The source code for all the [SD|RX|AGO]bot variants is easily found on 
the web. Recompile in Visual Basic, pack with UPX (or whatever) and off 
you go.

To prison that is...

Meanwhile .. a quick look at your email :

Received: from blueberry ( [69.3.80.94])
        by mx.google.com with ESMTP id i20sm9690041wxd.2006.11.26.14.32.22;
        Sun, 26 Nov 2006 14:32:22 -0800 (PST)
From: "kikazz" <kikazz () gmail com>

suggests that you aren't a teacher at all ..

network:IP-Network-Block:69.3.80.88 - 69.3.80.95
network:Org-Name:Compu' Counts Consulting Inc.
network:Street-Address:6174 Darleon Place
network:City:ALEXANDRIA
network:State:VA
network:Postal-Code:22310

<sigh> .. another consultant that is trying to get other folks to do his 
dirty work...

Cheers,

Michael Holstein CISSP GCIA
Information Security Administrator
Cleveland State University

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/