[NTLUG:Discuss] ICMP connection request to port 2048

[MadHat]

On Wed, 2003-08-20 at 04:38, Joe Martin wrote:
> Not sure, but the last two days I have received over a 100 such emails, they
> all have one thing in common , their ip address of
> (65-69-80-6.instituteforms.biz). Does that sound familiar. I would dearly
> love to zap this person.

If you are going to be on the Internet you are going to have to pay
attention to the latest Virii and Worms, mostly from MS products.  They
will affect your life even if you run Linux.

Latest email virus, that some have dubbed fastest spreading.
http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html

This looks like what you are describing above, and that is just a dialup
account IP, most likely infected.  And of course this is another of the
"click me" variant of worms, as far as I can tell.


Latest fully automated worm has had several variants.  They all appear
to ping before attacking, and they use the Windows RPC and
WebDAV/NTDLL.dll vulnerabilities.
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.b.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.c.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.

Which I think is what started this thread.


NOTE: Joe, I am hoping you are on the list.  Make sure you are sending
from the account you are subscribed, I had to approve your post.



> Joe/ Euless
> ----- Original Message -----
> From: "Tom Tumelty" <tumelty4 at yahoo.com>
> To: <discuss at ntlug.org>
> Sent: Wednesday, August 20, 2003 12:08 AM
> Subject: [NTLUG:Discuss] ICMP connection request to port 2048
> 
> 
> > Does anybody know of a virus that would request ICMP
> > connection to port 2048. The last 2 days I have many
> > attempts to connect to this port from many different
> > addresses. I am running XP.
> >
> > Thanks,
> > Tom
> >
> > __________________________________
> > Do you Yahoo!?
> > Yahoo! SiteBuilder - Free, easy-to-use web site design software
> > http://sitebuilder.yahoo.com
> >
> > _______________________________________________
> > https://ntlug.org/mailman/listinfo/discuss
> 
> 
> _______________________________________________
> https://ntlug.org/mailman/listinfo/discuss
-- 
MadHat at Unspecific.com
`But I don't want to go among mad people,' Alice remarked.
`Oh, you can't help that,' said the Cat: `we're all mad here...'
   -- Lewis Carroll - _Alice's_Adventures_in_Wonderland_