On Sat, Sep 14, 2002 at 01:41:06PM -0400, Noah L. Meyerhans wrote: > There are two worms. One is old, one is new. The one at > http://217.24.0.78/bugtraq.c.txt is the new one. It communicates via > UDP port 2002, though I'm not actually sure what data gets sent on that > port. The old worm used UDP port 2001, and showed up shortly after the > original OpenSSL vulnerability in late July. Its source is at > http://dammit.lt/apache-worm/apache-worm.c
Ah, I wondered what it was. I've been seeing that port getting battered upon since at least last night that I noticed. Thanks for the info. I've blocked it going into an ISP I watch over.