[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    Re: [Full-disclosure] New Variant of the Storm Virus
From:       eflorio <eflorio () edmaster ! it>
Date:       2007-02-28 20:58:47
Message-ID: 20070228205847.abef8322 () mbox ! edmaster ! it
[Download RAW message or body]

The web-component of the new StormWorm variant is distributed by the following domains:
mailfreepostcards.com
postcardsbargain.com
2007postcards.com
ecolorpostcards.com
bestnetpostcards.com
freewebpostcards.com

They all resolve to 209.123.8.198 at the moment.
The remote page could be "funvideo.html", "clip.html" or "winner.html".

More info here:
http://www.symantec.com/enterprise/security_response/weblog/2007/02/mespam_infecting_web_20_with_l.html


EF

----- Original Message -----
From: gerald.m.davis
[mailto:gerald.m.davis@verizonbusiness.com]
To:
full-disclosure@lists.grok.org.uk, 'WASC Forum'
[mailto:websecurity@webappsec.org]
Sent: Wed, 28 Feb 2007 21:40:49
+0100
Subject: [Full-disclosure] New Variant of the Storm Virus


> Was just reading an article about a new variant or what is believe to be a
> varient of the Storm Virus and am trying to find out more information about
> it in order to put appropriate IP/Domain blocks and counter messures in
> place. 
> 
> Specifically I am looking to determing the Domain(s)and IP address to block
> as well as possible obtaining a copy of the code to reverse engineer.
> 
> If anyone has more information on this I would appreciate the feedback. 
> 
> Article of interest:
> http://www.networkworld.com/news/2007/022707-storm-virus-blogs.html?nlhtsec=
> 0226securityalert3&company=SonicWall
> 
> 
> Thanks,
> Gerry
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]