[Dshieldannounce] Rapid increase in port 3127 scans

["Johannes B. Ullrich" <[EMAIL PROTECTED]>]

Today, we observed a rapid increase in port 3127 scans. This is likely
an attempt to find, and possibly exploit, hosts infected with
MyDoom/Novarg.

At this point, the purpose of these scans is not yet clear, but it is
likely, that the goal is to install additional malware.


If you find a MyDoom/Novarg infected host, please take extra steps to
ensure that no additional malware is present on this host. The standard
MyDoom/Novarg removal procedures will only remove the Virus, not any
additional malware that may have been installed via the backdoor.


-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 837 2807                          [EMAIL PROTECTED] 

contact details: http://johannes.homepc.org/contact.htm

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
Dshieldannounce mailing list
[EMAIL PROTECTED]
http://www.dshield.org/mailman/listinfo/dshieldannounce