All things related to multicast

[Bill Owens <>]

On Thu, 1 Feb 2001, Marshall Eubanks wrote:
> That's AS 680. My (occassional) downloads of the MSDP tables show no
> previous SA's from
> that AS, so they don't do this that often. Maybe RAMEN has mutated.

Ramen has definitely mutated; the copy that I got from the infected
machine in Spain last night contains what looks to me like elements of a
rootkit, it attempts to send copies of /etc/shadow to two different
maildrops, and it may contain other nastiness as well. I referred it to
Dave Dittrich, who is much better qualified than I to deal with such
things.

Bill.