Re: Packet from port 80 with spoofed microsoft.com ip

From: Pat Wilson <paw(at)noh.ucsd.edu>
Date: Fri Jan 31 2003 - 16:42:01 EST

Hmm. One of the writeups on Netspree says that it connects to an IRC channel on "master.leet-gamer.net" which now reverses to 127.0.0.1. Anyone know what its address was before someone was "helpful"? Apparently the address is hardcoded in the worm someplace, but I don't have a copy to play with (yet).

Thanks.

Pat Wilson
Network Security Manager
UCSD ACS/Network Operations
paw@ucsd.edu
6F3A AE75 F931 3A19 D207 19F3 DB9B 29DC 2C3F E015

"Larsen, Colin" <colin.larsen@nz.unisys.com> writes:
>
> Looks like the Netspree worm. We had it infect 3 or 4 PCs yesterday. It

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Sun Feb 2 11:33:42 2003