Re: [Unusual Network_scan[tcp-6267]]

From: Patrick Benson (bensonat_private)
Date: Thu Jan 31 2002 - 14:40:04 PST


Russell Fulton wrote:
> 
> Anyone have any idea what this might be looking for?  I ususally assume
> that scans on odd port numbers are just looking for hosts compromised in
> previous sweeps but 6267 is a bit too close to 6112 and I want to be
> sure that it isn't another rpc service I don't know about.  I have
> searched the snort port database and google but found nothing relevant.
> 
> Cheers, Russell.

Maybe it's looking for this:

http://www.megasecurity.org/trojans/guangwaigirl/Guangwaigirl1.0a.html


-- 
Patrick Benson
Stockholm, Sweden

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com



This archive was generated by hypermail 2b30 : Fri Feb 01 2002 - 12:41:50 PST