Kuang2

[z0mbi3]

I've recently noticed a large increase in Kuang2 port probes against my network. I done my research and it seems that more people that just myself are expericencing this increase in port 17300 probes. Kuang2 is a relatively old virus/trojan(1999) and am wondering if something bigger is at play here, like zombies being gathered for a DDOS in the near future or maybe even a launch pad for the next large scale virus. Has anyone heard anything about the possibility of ethier one of these scenarios? Does anyone know if any variants have been found that affect Windows 2000 or Windows NT yet?

Also does anyone have a snort signature for Kuang2 or better yet a link to download the actual program.

[thehorse13]

One can only guess but one thing to keep in mind is that old viruses, trojans, etc. commonly reappear after some time has passed.

This may help you:
http://www.lurhq.com/sig-milkit.htm
http://packetstormsecurity.nl/Crackers/kuang2/

[PabloEskobar]

But ther is a lot of new version of Kuang2.....

Ther is a kuang4, kuang4sserver, kuang4passwordsender ect.


Go to some antivirus co. and look fot answers!

[willy]

Yeah, you are definately not alone, z0mbi3. My eyes almost popped out of my head when I looked at my outpost logs last night. Thanks for the links thehorse13.

[Tedob1]

same here but i think that will soon be dwarfed by 1028 scans with the rapid spread of bugbearb