RE: [Full-Disclosure] Which worm?

["bob sagart" <bobsagart500@xxxxxxxxxxx>]

Heres the capture file I got, I started sending this to individual people 
but I decided to send it to the whole list so sorry if your one of the ones 
that got it twice. the zip file password is: pass


> From: "bob sagart" <bobsagart500@xxxxxxxxxxx>
> To: full-disclosure@xxxxxxxxxxxxxxxx
> Subject: [Full-Disclosure] Which worm?
> Date: Tue, 13 Apr 2004 23:53:17 +1200
> MIME-Version: 1.0
>
> Hey everyone
> The other night I decided to see what traffic I could capture on tcp port 
> 3127 (MyDoom backdoor) since I have been getting a lot of connection 
> attemps showing up in my firewall logs.
> I got several dumps of the traffic using
> nc -l -p 3127 > out.dmp
> most of them are around 10-20kB which I thought was the about the right 
> size of most of the worms and backdoors using that port. But one of the 
> dumps I got was 150kB and I was just wondering if anyone could tell me what 
> I might be?
> I cannot send it as an attachment as hotmail says it is a virus.
> Thanks.
>
> _________________________________________________________________
> Check out news, entertainment and more @  http://xtra.co.nz/broadband
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_________________________________________________________________
Check out news, entertainment and more @  http://xtra.co.nz/broadband

Attachment: net3.zip
Description: Zip compressed data