Have you known of a virus/worm designed to take
down an Oracle server (port 1521)?

On a very related note:
I captured and froze a virus/worm in my recently
installed RedHat Linux 7.3 server. There were several
files in /usr/sbin/ such as: mech, mech.info, mech.*, etc.

A 'ps aux' revealed a "cp ./mech" which is definitely
self replicating stuff.

Apparently this virus takes its name from a "Mech Assault"
video game.

Any info on this mech virus is very much appreciated.

-Ramon

ramon (AT) conexus (DOT) net (Ramon F Herrera) wrote in message news:<c9bc36ff.0307140619.4ac7a030 (AT) posting (DOT) google.com>...

Sounds like you want to talk to the folks at f-secure.com

jg
--
@home.com is bogus.
http://metalink.oracle.com/metalink/..._id= 217395.1

"Ramon F Herrera" <ramon (AT) conexus (DOT) net> wrote


http://search.cert.org/query.html?qt=oracle+1521


--
use hotmail com for any email replies


-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 80,000 Newsgroups - 16 Different Servers! =-----

< Ramon F Herrera

This is the EnergyMech. Stand-alone `emech` is not a virus/worm/game/
Oracle but an IRC bot. In most case, it's installed by intruder manually
or by autorooter. If it behave like virus, `emech` is infected some
ELF virus. Isn't the port 1521 some backdoor?

--
Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
----+----1----+----2----+----3----+----4----+----5----+----6----+----7

Hi Ramon F Herrera, thanks for writing this:
Well, Oracle kinda opens itself to hacker attack when they send out
brochures and place display ads that boast "only Oracle makes Linux
Unbreakable." The penguin in a suit of armor is cute, but I doubt
there's any software product that is "unbreakable." You can see the
related article in the July/August 2003 Oracle Magazine.
--
[:%s/Karsten Farrell/Oracle DBA/g]