RE: [Full-Disclosure] Sobig has a surprise...

[Paul Schmehl <pauls@utdallas.edu>]

--On Friday, August 22, 2003 1:27 PM -0600 Jonathan Grotegut 
<jgrotegut@directpointe.com> wrote:
>
> Anyone able to verify this with another site (eeye, any other antivirus
> firm)?
>
I can verify this.  I wrote a snort rule that looks for outgoing packets to 
8998/UDP and I saw machines hitting 20 unique IPs on that port.  So I can 
confirm that it is true.

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html