Re: [Sheflug] Ramen worm

[Matt Fairtlough <nospam [at] blueyonder.co.uk>]

Alex Hudson wrote:

<snip>

> Yep, Ramen only attacks via ftpd pretty much. People also say it
> exploits lpd, but I don't know if that's an entry system for it. It's
> most likely that the worm / virus in question is Ramen, but it could be
> a variant, you never know. You don't know who's going to have been
> messing with it.

It's the original Ramen all right, and it definitely isn't a virus.
Symptoms identical to those described at

http://whitehats.com/library/worms/ramen/

including the redundant and inoperative code.

Matt.

--
 --------------------------------------------
| Matt Fairtlough       22 Harley Road       |
| Sheffield S11 9SE UK  tel. 0114 236 2067   |
 --------------------------------------------



---------------------------------------------------------------------
Sheffield Linux User's Group - http://www.sheflug.co.uk
To unsubscribe from this list send mail to
- <sheflug-request [at] vuw.ac.nz> - with the word 
 "unsubscribe" in the body of the message. 

  GNU the choice of a complete generation.