North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: New Worm
On Fri, Sep 14, 2001 at 11:04:23AM -0500, Ejay Hire wrote: > My Honeypot was infected with a new self-replicating worm yesterday. > It appears to check for open win95/98/me netbios shares with read/write > permission and installs wininit.exe (the scanner/infector) and the > distributed.net client (In quiet Mode). Matches the MO of W32.HLLW.Bymer, a pretty old one that hit my parents' PC a while back: http://www.symantec.com/avcenter/venc/data/w32.hllw.bymer.html -- Jeff Gehlbach, Concord Communications <[email protected]> Senior Professional Services Consultant, Atlanta ph. 770.384.0184 fax 770.384.0183
|