[Snort-users] Port 10008??

LEFEVRE David David.LEFEVRE at ...2178...
Wed Jun 6 03:40:16 EDT 2001


It's the Lion worm.
See :

http://www.whitehats.com/library/worms/lion/

Someone checking for livegate.
http://www.live.com/liveGate/stats.html

Someone checking for an Eris Server. (catalog runs on 10008)
http://filebox.vt.edu/cc/cst/documentation/

Cheers,
David

sevald.lund at ...2176... wrote:

> Hello!
> Our network has been scanned for port 10008. Do anybody know what this is?
> Trojan??
>
> Sevald O. Lund
> ____________________________________________________________________________
> ______
> Eterra as,
> Stiklestadveien 3
> 7489 TRONDHEIM
> http://www.eterra.no
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
David LEFEVRE
CARDIF - Architecture et Sécurité Opérationnelle
david.lefevre at ...2178... - Tél : 01 41 42 76 63


**********************************************************************
L'intégrité de ce message n'étant pas assurée sur Internet,
CARDIF ne peut être tenu responsable de son contenu.
Si vous n'êtes pas destinataire de ce message confidentiel,
Merci de le détruire et  d'avertir immédiatement l'expediteur.

The integrity of this message cannot be guaranteed on the
Internet. CARDIF can not therefore be considered responsible 
for the contents. 
If you are not the intended recipient of this confidential message,
then please delete it and notify immediately the sender.

**********************************************************************




More information about the Snort-users mailing list