On Mon, 30 Sep 2002, Ferry van Steen wrote: > did anyone else notice a huge increase in port 137 scans (UDP)? Usually I > had perhaps 1 a day of those. Now I've seen atleast 10 in the past 2 hours > alone.
There are a couple of new worms making the rounds. Both scan UDP 137. Bugbear (note: Bugbear also sets up a listening webserver on TCP 36794) http://vil.nai.com/vil/content/v_99728.htm http://www.sophos.com/virusinfo/analyses/w32bugbeara.html Scrup http://vil.nai.com/vil/content/v_99729.htm http://www.sophos.com/virusinfo/analyses/w32opaserva.html -- Su Wadlow [EMAIL PROTECTED] If I have to explain, you wouldn't understand. :-)
