Rule:  --Sid:2375--Summary:This event is generated when activity from the worm DoomJuice isdetected. --Impact:This is indicative of worm activity which may launch of a Denial ofService condition against Microsoft from infected machines.--Detailed Information:This event is indicative of activity by the DoomJuice worm. This wormattempts to connect to random addresses on port 3127, if it receives aresponse it will attempt to upload a copy of itself to the targetmachine. If no response is received on that port, it will try on portsbetween 3127 and 3199.If the date is between February 8th and February 28th 2004, the wormwill attempt to launch a Denial of Service (DoS) attack againstwww.microsoft.com.--Affected Systems:	Windows 95	Windows 98	Windows Me	Windows NT	Windows 2000	Windows XP	Windows Server 2003--Attack Scenarios:This is worm activity.--Ease of Attack:Simple.--False Positives:None Known--False Negatives:It is possible to edit the binary data in the executable to create avariant of the worm. This may evade the rule.--Corrective Action:Use Anti-Virus software to remove the worm.--Contributors:Sourcefire Research TeamMatt Watchinski <matthew.watchinski@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>-- Additional References:--