>
>
> Hansen, Kevin wrote:
>
>> We have seen multiple instances where DHCP enabled workstations have had
>> their DNS reconfigured to point to two of the three addresses listed
>> below.
>> Can anyone else confirm this? Incidents.org is reporting an increase
>> in port
>> 53 traffic over the last two days. Are we looking at the precursor to the
>> next worm?
>
>
> This is currently being discussed on NTBUGTRAQ too.
>
>
McAfee labels it QHosts-1
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
Brian
-- Brian Eckman Security Analyst OIT Security and Assurance University of Minnesota 612-626-7737
"There are 10 types of people in this world. Those who understand binary and those who don't."
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
