North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: New Worm

  • From: Jeff Gehlbach
  • Date: Fri Sep 14 11:33:39 2001

On Fri, Sep 14, 2001 at 11:04:23AM -0500, Ejay Hire wrote:
> My Honeypot was infected with a new self-replicating worm yesterday.
> It appears to check for open win95/98/me netbios shares with read/write
> permission and installs wininit.exe (the scanner/infector) and the
> client (In quiet Mode).

Matches the MO of W32.HLLW.Bymer, a pretty old one that hit my parents'
PC a while back:

Jeff Gehlbach, Concord Communications <[email protected]>
Senior Professional Services Consultant, Atlanta
ph. 770.384.0184  fax 770.384.0183