It's the Lion worm.
See :

http://www.whitehats.com/library/worms/lion/

Someone checking for livegate.
http://www.live.com/liveGate/stats.html

Someone checking for an Eris Server. (catalog runs on 10008)
http://filebox.vt.edu/cc/cst/documentation/

Cheers,
David

sevald.lundeterra.no wrote:

> Hello!
> Our network has been scanned for port 10008. Do anybody know what this is?
> Trojan??
>
> Sevald O. Lund
> ____________________________________________________________________________
> ______
> Eterra as,
> Stiklestadveien 3
> 7489 TRONDHEIM
> http://www.eterra.no
>
> _______________________________________________
> Snort-users mailing list
> Snort-userslists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
David LEFEVRE
CARDIF - Architecture et Sécurité Opérationnelle
david.lefevrecardif.fr - Tél : 01 41 42 76 63
**********************************************************************
L'intégrité de ce message n'étant pas assurée sur Internet,
CARDIF ne peut être tenu responsable de son contenu.
Si vous n'êtes pas destinataire de ce message confidentiel,
Merci de le détruire et  d'avertir immédiatement l'expediteur.
The integrity of this message cannot be guaranteed on the
Internet. CARDIF can not therefore be considered responsible 
for the contents. 
If you are not the intended recipient of this confidential message,
then please delete it and notify immediately the sender.
**********************************************************************
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]