Re: [tlug] possible trojan..not sure...help please

[Godwin Stewart <gstewart@example.com>]

And Thus Spake "Thomas Kruemmer" <tkruemmer@example.com> (on Wed, 16 Apr
2003 08:42:52 +0900):

> It spreads by scanning random class B IP networks for hosts that are
> vulnerable to a remote exploit in the Bind name service daemon. Once it
> has found a candidate for infection it attacks the remote machine and, if
> successful, downloads and installs a package from coollion.51.net.

I take it this means that if I'm running a non-vulnerable BIND, or if my
BIND isn't open to the world (only used as a local nameserver) then I'm safe
from this one?

I run a dailiy chkrootkit on my box but you can never be too sure!

-- 
G. Stewart   --   gstewart@example.com -- gstewart@example.com
Registered Linux user #284683
---------------------------------------------------------------
"POLICE STATION TOILET STOLEN...Cops have nothing to go on."

Attachment: pgp00058.pgp
Description: PGP signature