Russell Fulton wrote: > > Anyone have any idea what this might be looking for? I ususally assume > that scans on odd port numbers are just looking for hosts compromised in > previous sweeps but 6267 is a bit too close to 6112 and I want to be > sure that it isn't another rpc service I don't know about. I have > searched the snort port database and google but found nothing relevant. > > Cheers, Russell. Maybe it's looking for this: http://www.megasecurity.org/trojans/guangwaigirl/Guangwaigirl1.0a.html -- Patrick Benson Stockholm, Sweden ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Fri Feb 01 2002 - 12:41:50 PST