[855] in resnet
New 'DoS-WinLock ' Virus and Port 18023 ?
daemon@ATHENA.MIT.EDU (Iain (ResTek) Davidson)
Fri Feb 15 21:20:59 2002
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-ID: <Pine.LNX.4.21.0202151751050.7122-100000@kulshan.restek.wwu.edu>
Date: Fri, 15 Feb 2002 18:10:11 -0800
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: "Iain (ResTek) Davidson" <iain@RESTEK.WWU.EDU>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <sc6d2511.064@gwhub1>
BTW, :-/
It maybe related, but our campus has been hit several times in the past
two weeks in adminstrative offices by the 'DoS-WinLock' virus.
McAfee: "DoS-Winlock" virus
http://vil.mcafee.com/dispVirus.asp?virus_k=99345
NAI/McAfee: "DoS-Winlock" virus
http://vil.nai.com/vil/content/v_99345.htm
Need the NAI/McAfee strings 4186 (2/13/2002) to be able to detect it.
We were first hit on 2/1/2002, I gave up on identifying it... and it looks
like several days later they released info about it. Look for
'C:\WINNT\ntdll16.exe' or 'C:\RECYCLED\winlock.exe'. Although, McAfee
says 'LOW' infection, I suspect it's bigger than they think.
It does a DoS attack on the 'langame.net' domain... but at the same time,
one PC filled our 12 Mbit Internet pipe during that time. It was scary to
watch it in action.
Just a heads up....
-Iain
On Fri, 15 Feb 2002, Denise Christenson wrote:
> We have a node here that we were told participated with 99 other nodes
> in a DDoS attack against a system at another site. The system was
> brought to my office, and as soon as I fired it up I checked and saw
> that it was connected to ip address 216.74.117.247 and listening on
> port 18023. I think it is a bot/zombie on the system that caused this,
> but the kid has downloaded so many files from mIRC, I have no idea
> which one holds the bot. I'm just curious and trying to figure this
> out for future reference. Anyone have any ideas on where I should
> start? Thanks, Denise
>
>
> Denise Christenson U. S. Naval Academy
> Network Engineer Information Technology Services
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
