UDP port 4000 traffic: likely a new worm

Looks like there may be a worm going around hitting systems that run BlackIce. Common characteristics of the packets: Source port 4000 (but random target port) and the string "insert witty message here". details will be posted here: http://isc.sans.org/diary.html as I get them together. -- CTO SANS Internet Storm Center http://isc.sans.org phone: (617) 837 2807 jullrich@sans.org contact details: http://johannes.homepc.org/contact.htm