Re: lug-bg: mydoom ?

["korio" <korio@xxxxxxxx>]

Hmz az puk si slojih badrcptto patch (hmf ne razbiram ot merge-wane na 
patches, no nakraq go skalupih da raboti zaedno s qmail-qregex) i si 
buildwam baza ot accounts kym, koito prashta, za da moga da gi spiram oshte 
predi da e stignal do vpopmail-a... 

raptor writes: 

> opa, 
>
> gotowi li ste za mydoom...
> kakwi merki wzimate...spodelete.. 
>
> Az sam blokiral attachmantite koito sa .exe/and similar/, obache chetoh che se .zip-wa.. 
>
> Move da polzwate i towa :
> iptables -p tcp --dport 3127 -j DROP 
>
> <snip>
> As part of it's normal operation, the worm sends out packets to port 3127 at random IP addresses. The purpose of these packets is to locate systems infected with W32/Mydoom@MM . If it makes contact with such a system, the worm then transmits a copy of itself to the second system where it is then executed by W32/Mydoom@MM . When the second system is next restarted, it then becomes infected with W32/Mydoom.b@MM  instead of the original W32/Mydoom@MM .
> </snip> 
>
> kato kraina mqrka move da se blokira accessa do sco.com, koi li i bez towa hodi tam..:")
> modifikaciqta mai ste atakuwa i microsoft.com, a tam weche e kofti stoto e polzwan sait...
WWell by
Iassen Anadoliev (aka korio) 

============================================================================
A mail-list of Linux Users Group - Bulgaria (bulgarian linuxers).
http://www.linux-bulgaria.org - Hosted by Internet Group Ltd. - Stara Zagora
To unsubscribe: http://www.linux-bulgaria.org/public/mail_list.html
============================================================================