[olug] trojans .. was Re: [olug] Worms!

[Kris Gotcu]

> Connection attempts to port 113 should be generally ignored and shouldn't
> even be reported as an "attack".

yes, that was the wrong way of putting it.  'requests' rather.  i did 
ask because of the overwhelming
number of requests i got the past 24 hours.  for interested parties:  i 
did find that 2 trojans usually
use port 113: Invisible Identd Deamon and Kazimas.  they are both 
windows trojans.

found some interesting links in the process:

trojan names and the ports they use:
(some of these lists are identical, some contain more information)
http://www.sys-security.com/html/papers/trojan_list.html
http://www.norman.no/virus_info/virus_lists_bin.shtml
http://www.sans.org/newlook/resources/IDFAQ/oddports.htm

this site has good descriptions of trojans
http://www.norman.no/virus_info/virus_descriptions.shtml
and to some extent so does this
http://www.eiffelzero1.hpg.com.br/trojanz.htm




---------------------------------------------------------------------
To unsubscribe, e-mail: olug-unsubscribe at bstc.net
For additional commands, e-mail: olug-help at bstc.net