Re: New worm to affect RH

[John Aldrich]

On Tue, 03 Apr 2001, you wrote:
> Hi,
>       I don't know if you could call it new, it's really a combo of everything that 
>we've seen as of late. 
>       it exploits bind, lpd, statd, and wu-ftp 2.6.0 .  The basic signs are that it 
>replaces /etc/cron.daily/0anacron with a hacked version of it to start the scans and 
>such.  Also after a day of scanning, the logs of the scan, the ip of the local box, 
>and the shadow are sent to an email address in china. [EMAIL PROTECTED] and 
>[EMAIL PROTECTED] .
> if anyone wants a copy of the worm email me and i'll send it to them.
> 
Hmm.. Sisna.com. Why am I not surprised! Sheesh!
        John



_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list