[Fwd: Re: [Full-Disclosure] Increase probe on UDP port 1026]

Brian Eckman wrote:
> (I am responding on behalf of myself, not Paul. I thought it might
> benefit the list to include a little more info, and I'm not sure if he
> was planning on replying.)
>
> Nick FitzGerald wrote:
>
>> Paul Dokas <dokas@cs.umn.edu> replied to Nicob:
>>
>>
>>>> I captured some packets and it appears to be (only) a Windows Messenger
>>>> "spam" for a "penis enlargement" product.
>>>
>>>
[snip]

"Support.com" sends out packets to this port. Most of "Support.com"
installs are done by users who click yes and get some malware installed
for them.

InCisT

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Received on Wed Dec 03 16:51:42 2003