incidents 2001/08
By Thread

Starting: Tue Jul 31 2001 - 15:14:58 PDT
Ending: Sat Sep 01 2001 - 11:12:48 PDT

• Re: The sky is falling, or so I am told. Nick FitzGerald (Tue Jul 31 2001 - 13:58:10 PDT)
• Code Red, anyone? Russell Fulton (Tue Jul 31 2001 - 19:37:49 PDT)
  • Re: Code Red, anyone? Joseph Nicholas Yarbrough (Wed Aug 01 2001 - 02:43:07 PDT)
  • Re: Code Red, anyone? Ken Eichman (Wed Aug 01 2001 - 03:10:17 PDT)
    • unsubscribe me please Christophe Bernigaud (Wed Aug 01 2001 - 07:42:32 PDT)
  • Re: Code Red, anyone? thomas lakofski (Wed Aug 01 2001 - 05:38:33 PDT)
  • RE: Code Red, anyone? Coen Bongers (Wed Aug 01 2001 - 03:56:43 PDT)
  • RE: Code Red, anyone? Information Security (Wed Aug 01 2001 - 06:09:01 PDT)
    • RE: Code Red, anyone? Chip McClure (Wed Aug 01 2001 - 07:52:38 PDT)
  • RE: Code Red, anyone? Jürgen Nieveler (Wed Aug 01 2001 - 07:41:01 PDT)
    • Re: Code Red, anyone? Seth Arnold (Wed Aug 01 2001 - 09:32:46 PDT)
  • Re: Code Red, anyone? Pat Wilson (Wed Aug 01 2001 - 07:46:27 PDT)
    • Re: Code Red, anyone? janat_private (Wed Aug 01 2001 - 08:35:54 PDT)
    • Re: Code Red, anyone? Pluto (Wed Aug 01 2001 - 08:29:29 PDT)
  • Re: Code Red, anyone? Michael Sullenszino (Wed Aug 01 2001 - 07:45:45 PDT)
  • RE: Code Red, anyone? Thompson, John J (Wed Aug 01 2001 - 07:55:15 PDT)
  • Re: Code Red, anyone? Ryan Russell (Wed Aug 01 2001 - 08:46:18 PDT)
    • Re: Code Red, anyone? Kman (Wed Aug 01 2001 - 09:16:03 PDT)
  • Re: Code Red, anyone? Alfred Huger (Wed Aug 01 2001 - 08:56:44 PDT)
    • Re: Code Red, anyone? Dirk Brockhausen (Wed Aug 01 2001 - 09:32:13 PDT)
    • Re: Code Red, anyone? Johannes B. Ullrich (Wed Aug 01 2001 - 16:25:24 PDT)
  • Re: Code Red, anyone? Chris A. Mattingly (Wed Aug 01 2001 - 09:19:25 PDT)
  • Re: Code Red, anyone? Ivan Andres Hernandez Puga (Wed Aug 01 2001 - 10:15:19 PDT)
  • RE: Code Red, anyone? kerveros (Wed Aug 01 2001 - 10:09:49 PDT)
  • RE: Code Red, anyone? Joe Lareau (Wed Aug 01 2001 - 10:04:49 PDT)
• ftp scans and socks Mark Borrie (Tue Jul 31 2001 - 22:07:49 PDT)
  • RE: ftp scans and socks Jonathan A. Zdziarski (Wed Aug 01 2001 - 05:24:54 PDT)
• CodeRed Activity dave.goldsmithat_private (Wed Aug 01 2001 - 04:53:52 PDT)
  • Re: CodeRed Activity Stuart Staniford (Wed Aug 01 2001 - 10:00:31 PDT)
    • Re: CodeRed Activity Ryan Russell (Wed Aug 01 2001 - 10:30:16 PDT)
      • Re: CodeRed Activity Stuart Staniford (Wed Aug 01 2001 - 10:49:24 PDT)
• Re: Code Red Conor McGrath (Wed Aug 01 2001 - 05:07:22 PDT)
• RE: Code Red Michael Tucker (Wed Aug 01 2001 - 07:37:00 PDT)
• Full Plate of Crow Alfred Huger (Wed Aug 01 2001 - 08:01:59 PDT)
  • Re: Full Plate of Crow Chris Brenton (Wed Aug 01 2001 - 08:52:09 PDT)
    • Re: Full Plate of Crow Russell Fulton (Wed Aug 01 2001 - 12:09:58 PDT)
  • RE: Full Plate of Crow McCammon, Keith (Wed Aug 01 2001 - 09:21:14 PDT)
• CodeRed Jim Forster (Wed Aug 01 2001 - 07:52:49 PDT)
• Snort Rules Jim Forster (Wed Aug 01 2001 - 08:18:56 PDT)
  • Netcat Capture.. Ken Pfeil (Wed Aug 01 2001 - 08:30:41 PDT)
• Code Red Etiquette for posting Alfred Huger (Wed Aug 01 2001 - 09:04:12 PDT)
  • Re: Code Red Etiquette for posting Vince Vielhaber (Wed Aug 01 2001 - 09:14:08 PDT)
• http://www.worm.com/default.ida? requests Sean Kelly (Wed Aug 01 2001 - 08:36:18 PDT)
  • RE: http://www.worm.com/default.ida? requests Johnston, Jack (Wed Aug 01 2001 - 11:06:26 PDT)
  • Re: http://www.worm.com/default.ida? requests Robin Stevens (Wed Aug 01 2001 - 11:07:21 PDT)
    • RE: http://www.worm.com/default.ida? requests Marc Maiffret (Wed Aug 01 2001 - 13:37:54 PDT)
• code red stats Mark Lastdrager (Wed Aug 01 2001 - 08:26:11 PDT)
• Code Red Activity Owen Creger (Wed Aug 01 2001 - 09:10:21 PDT)
• explanation (fwd) Alfred Huger (Wed Aug 01 2001 - 09:35:13 PDT)
• RE: CRv3? Or some other ida type Pat Moffitt (Wed Aug 01 2001 - 09:35:07 PDT)
• Code Red Scan Jonathan Rickman (Wed Aug 01 2001 - 09:51:42 PDT)
  • RE: Code Red Scan Richard Bradford (Wed Aug 01 2001 - 10:30:53 PDT)
• Re: Code Red, anyone? now DOS threat ;-) Richard.Grevisat_private (Wed Aug 01 2001 - 09:56:20 PDT)
• red Dino Amato (Wed Aug 01 2001 - 10:19:02 PDT)
• Code red probe followed by udp port 10xx Thompson, John J (Wed Aug 01 2001 - 10:24:23 PDT)
• Code Red hits Powers, James L. (Wed Aug 01 2001 - 10:29:55 PDT)
  • RE: Code Red hits Portnoy, Gary (Wed Aug 01 2001 - 10:57:16 PDT)
    • Re: Code Red hits Michael Tavares (Wed Aug 01 2001 - 13:30:12 PDT)
  • RE: Code Red hits Bryan Willis (Wed Aug 01 2001 - 14:27:34 PDT)
  • RE: Code Red hits Dave Salovesh (Wed Aug 01 2001 - 15:24:52 PDT)
    • Code Red hits from inside network? Nuno Fernandes (Wed Aug 01 2001 - 18:33:52 PDT)
• Forwarded: 13:00 EDT http scan update from cas.org [CERT#36881] Ken Eichman (Wed Aug 01 2001 - 10:37:18 PDT)
• Code Red Scans Nicholas Bachmann (Wed Aug 01 2001 - 10:32:59 PDT)
• A note about logging hostname vs. IP address Ryan Russell (Wed Aug 01 2001 - 10:27:29 PDT)
• code red scan update Kevin Holmquist (Wed Aug 01 2001 - 10:32:50 PDT)
• Possible method to prevent spread of CodeRed and other similar wo rms dave.goldsmithat_private (Wed Aug 01 2001 - 10:47:38 PDT)
  • Re: Possible method to prevent spread of CodeRed and other similar worms Chris Brenton (Wed Aug 01 2001 - 13:53:29 PDT)
• code red scans Ed Miles (Wed Aug 01 2001 - 11:02:58 PDT)
  • RE: code red scans Ralph Gervolino (Wed Aug 01 2001 - 11:33:36 PDT)
• I will start posting summaries. Alfred Huger (Wed Aug 01 2001 - 11:14:56 PDT)
  • Re: I will start posting summaries. Ken Lyon (Wed Aug 01 2001 - 12:36:22 PDT)
  • RE: I will start posting summaries. McCammon, Keith (Wed Aug 01 2001 - 14:37:16 PDT)
• A new Code Red variant Scott Wunsch (Wed Aug 01 2001 - 11:06:42 PDT)
  • RE: A new Code Red variant Steve Halligan (Wed Aug 01 2001 - 11:29:33 PDT)
    • Apache Logs and Code Red andrew (Wed Aug 01 2001 - 12:29:31 PDT)
  • Re: A new Code Red variant Blake Frantz (Wed Aug 01 2001 - 11:53:35 PDT)
  • RE: A new Code Red variant JKruser (Wed Aug 01 2001 - 11:41:55 PDT)
  • RE: A new Code Red variant Andrew Cardwell (Wed Aug 01 2001 - 11:03:05 PDT)
    • Re: A new Code Red variant Scott Wunsch (Wed Aug 01 2001 - 12:15:35 PDT)
    • Re: A new Code Red variant jason (Wed Aug 01 2001 - 14:36:18 PDT)
      • Re: A new Code Red variant Daniel Harrison (Wed Aug 01 2001 - 14:36:26 PDT)
• RE: Possible method to prevent spread of CodeRed and other simila r wo rms dave.goldsmithat_private (Wed Aug 01 2001 - 11:22:15 PDT)
  • RE: Possible method to prevent spread of CodeRed and other simila r wo rms Sachs, Marcus (Wed Aug 01 2001 - 11:18:40 PDT)
  • RE: Possible method to prevent spread of CodeRed and other simila r wo rms Frank Knobbe (Wed Aug 01 2001 - 11:34:25 PDT)
  • RE: Possible method to prevent spread of CodeRed and other simila r wo rms McCammon, Keith (Wed Aug 01 2001 - 11:33:50 PDT)
  • RE: Possible method to prevent spread of CodeRed and other simila r wo rms Delaney, Gavin J (EASD, IT) (Wed Aug 01 2001 - 12:26:11 PDT)
    • Re: Possible method to prevent spread of CodeRed and other simila r wo rms Sebastian Ip (Wed Aug 01 2001 - 20:12:23 PDT)
  • RE: Possible method to prevent spread of CodeRed and other simila r wo rms corecode (Wed Aug 01 2001 - 14:17:55 PDT)
• Determining Version Ryan Russell (Wed Aug 01 2001 - 11:49:11 PDT)
• CodeRed Traffic Stats dave.goldsmithat_private (Wed Aug 01 2001 - 12:38:04 PDT)
• CodeRed and IIS dave.goldsmithat_private (Wed Aug 01 2001 - 12:44:11 PDT)
• Current numbers - Code Red Alfred Huger (Wed Aug 01 2001 - 14:14:06 PDT)
• Code Red side effects Jonathan Rickman (Wed Aug 01 2001 - 14:33:59 PDT)
  • RE: Code Red side effects Ken Pfeil (Wed Aug 01 2001 - 14:59:45 PDT)
  • Re: Code Red side effects Opus (Wed Aug 01 2001 - 19:05:37 PDT)
  • RE: Code Red side effects Portnoy, Gary (Thu Aug 02 2001 - 05:50:26 PDT)
  • RE: Code Red side effects ren stimpy (Thu Aug 02 2001 - 06:57:54 PDT)
• code red.. one funny detail B. (Wed Aug 01 2001 - 15:39:17 PDT)
• CRv2 August 1st dynamics Stuart Staniford (Wed Aug 01 2001 - 18:06:13 PDT)
  • RE: CRv2 August 1st dynamics Ken Williams (Thu Aug 02 2001 - 12:46:44 PDT)
• Re: Code red probe followed by udp port 10x Paul Gear (Wed Aug 01 2001 - 17:47:59 PDT)
  • Re: Code red probe followed by udp port 10x Paul Gear (Thu Aug 02 2001 - 07:00:38 PDT)
• Code Red Stats Nicholas Bachmann (Wed Aug 01 2001 - 15:51:16 PDT)
  • Re: Code Red Stats Alex Butcher (Thu Aug 02 2001 - 02:35:24 PDT)
• A bit of Code Red research cg (Wed Aug 01 2001 - 17:07:45 PDT)
• Code Red Thread is Dead, more or less. Alfred Huger (Wed Aug 01 2001 - 18:28:30 PDT)
• Code Red v2 ? Owen Creger (Wed Aug 01 2001 - 13:29:09 PDT)
  • RE: Code Red v2 ? Colby Rice (Thu Aug 02 2001 - 07:06:29 PDT)
• Code Red in the media Brian Cervenka (Wed Aug 01 2001 - 09:41:53 PDT)
• codered/general simple honeypot corecode (Wed Aug 01 2001 - 19:04:51 PDT)
• Code Red - same IPs or different? Kee Hinckley (Wed Aug 01 2001 - 19:06:33 PDT)
• Code Red capture tool Stephen Friedl (Wed Aug 01 2001 - 20:11:04 PDT)
• isakmp Suzi VP (Thu Aug 02 2001 - 06:48:45 PDT)
  • RE: isakmp baudendistat_private (Thu Aug 02 2001 - 11:46:32 PDT)
    • Re: isakmp Valdis.Kletnieksat_private (Thu Aug 02 2001 - 12:21:57 PDT)
  • RE: isakmp Portnoy, Gary (Thu Aug 02 2001 - 11:19:42 PDT)
• Increasing Port 137 Scan rate Xno Xutz (Thu Aug 02 2001 - 05:55:02 PDT)
  • RE: Increasing Port 137 Scan rate Jonathan A. Zdziarski (Thu Aug 02 2001 - 11:44:48 PDT)
• Re: Rooted Linux Box Foresensics Questions Nick Lange (Thu Aug 02 2001 - 06:08:15 PDT)
• Been a pet theory of mine all this time (CodeRed) Richard (Thu Aug 02 2001 - 11:34:22 PDT)
  • RE: Been a pet theory of mine all this time (CodeRed) Emery, Ralph (ISSAtlanta) (Thu Aug 02 2001 - 13:29:08 PDT)
• AOL hackings Jonathan A. Zdziarski (Thu Aug 02 2001 - 07:16:06 PDT)
  • Re: AOL hackings Meritt James (Thu Aug 02 2001 - 11:41:18 PDT)
  • RE: AOL hackings Jonathan A. Zdziarski (Thu Aug 02 2001 - 11:49:53 PDT)
  • RE: AOL hackings Jonathan A. Zdziarski (Thu Aug 02 2001 - 14:14:15 PDT)
• Strange connection attempts Andrea Efstathiou (Fri Aug 03 2001 - 09:26:44 PDT)
• "prepare to be owned" Michael Hendricks (Fri Aug 03 2001 - 14:38:41 PDT)
• CodeRed logfile scanner... Christian Vogel (Fri Aug 03 2001 - 10:36:16 PDT)
• RE: Code red probe followed by udp port 10x Michael Tucker (Thu Aug 02 2001 - 13:40:23 PDT)
• ACK scan Todd Ransom (Fri Aug 03 2001 - 07:35:22 PDT)
  • Re: ACK scan - RESOLUTION Todd Ransom (Fri Aug 10 2001 - 07:27:50 PDT)
• Scanning Customers. Tyler Walden (Thu Aug 02 2001 - 16:27:49 PDT)
  • Re: Scanning Customers. Vachon, Scott (Mon Aug 06 2001 - 05:39:35 PDT)
• RE: [fw-wiz] Re: Code Red: What security specialist don't mention in warnings (Frank Knobbe) dave.goldsmithat_private (Thu Aug 02 2001 - 14:02:21 PDT)
• CRv3? Wayne Conrad (Sat Aug 04 2001 - 07:59:39 PDT)
• new variant? Stephen Friedl (Sat Aug 04 2001 - 08:34:49 PDT)
• New variant of Code Red? Sven Carstens (Sat Aug 04 2001 - 09:10:31 PDT)
• Code Red II Stephen Friedl (Sat Aug 04 2001 - 10:59:31 PDT)
• code red: X marks ... terry white (Sat Aug 04 2001 - 14:28:01 PDT)
• Code Red variant only from 24.x.x.x? Michael Katz (Sat Aug 04 2001 - 12:44:14 PDT)
• new codered variant corecode (Sat Aug 04 2001 - 12:01:10 PDT)
  • Re: new codered variant (very initial analysis) Antony Riley (Sat Aug 04 2001 - 13:38:32 PDT)
• CRV3 Wayne Conrad (Sat Aug 04 2001 - 14:16:44 PDT)
• Code red variation sends Os instead of Ns - seems to be running at a higher rate Fred Cohen (Sat Aug 04 2001 - 19:20:19 PDT)
• Code Red Revision Alfred Huger (Sat Aug 04 2001 - 22:00:39 PDT)
• CodeRed II (fwd) Ryan Russell (Sat Aug 04 2001 - 22:56:20 PDT)
• snort signature for new CodeRed varient J Moll (Sat Aug 04 2001 - 23:21:11 PDT)
  • Re: snort signature for new CodeRed varient David Brown (Sun Aug 05 2001 - 00:00:35 PDT)
    • Re: snort signature for new CodeRed varient Joe Moll (Sun Aug 05 2001 - 19:20:07 PDT)
• CodeRedII - New non-variant codered worm - Analysis. Marc Maiffret (Sun Aug 05 2001 - 05:23:39 PDT)
  • RE: CodeRedII - New non-variant codered worm - Analysis. Michael Katz (Sun Aug 05 2001 - 09:56:35 PDT)
    • RE: CodeRedII - New non-variant codered worm - Analysis. corecode (Sun Aug 05 2001 - 12:21:35 PDT)
  • RE: CodeRedII - New non-variant codered worm - Analysis. Josh Ballard (Sun Aug 05 2001 - 15:42:58 PDT)
• CodeRed II ARIS Incident Analysis Ryan Russell (Sun Aug 05 2001 - 05:45:13 PDT)
• Conclusion for the dirrent Code Red URL's.... Daniel Mostertman (Sun Aug 05 2001 - 01:33:06 PDT)
  • Re: Conclusion for the dirrent Code Red URL's.... Ryan Russell (Sun Aug 05 2001 - 09:35:31 PDT)
• Scanning pattern Stephen Friedl (Sun Aug 05 2001 - 01:00:38 PDT)
• code red variant ida_root now completely analyzed corecode (Sun Aug 05 2001 - 04:20:27 PDT)
• CodeRedII worm.. Valdis.Kletnieksat_private (Sun Aug 05 2001 - 01:38:55 PDT)
  • Re: CodeRedII worm.. Pluto (Sun Aug 05 2001 - 11:23:51 PDT)
    • Re: CodeRedII worm.. A.L.Lambert (Sun Aug 05 2001 - 16:51:47 PDT)
    • Re: CodeRedII worm.. Nick FitzGerald (Mon Aug 06 2001 - 00:19:01 PDT)
  • Re: CodeRedII worm.. Nick FitzGerald (Mon Aug 06 2001 - 00:19:01 PDT)
  • Re: CodeRedII worm.. Emory Wood (Mon Aug 06 2001 - 02:09:22 PDT)
• How to obtain a complete list of CR2 compromised hosts aleph1at_private (Sun Aug 05 2001 - 10:32:22 PDT)
  • Re: How to obtain a complete list of CR2 compromised hosts Joe Shaw (Sun Aug 05 2001 - 23:51:27 PDT)
    • Re: How to obtain a complete list of CR2 compromised hosts Kee Hinckley (Mon Aug 06 2001 - 10:16:54 PDT)
      • Re: How to obtain a complete list of CR2 compromised hosts Jay D. Dyson (Mon Aug 06 2001 - 12:41:19 PDT)
• a suggestion Raistlin (Sun Aug 05 2001 - 12:55:21 PDT)
• Code Red III - increased ARPing on shared segment broadband Chad Loder (Sun Aug 05 2001 - 12:46:32 PDT)
• Now the kiddiez started playing Sven Carstens (Sun Aug 05 2001 - 13:23:25 PDT)
  • Re: Now the kiddiez started playing Sven Carstens (Sun Aug 05 2001 - 13:58:42 PDT)
  • Re: Now the kiddiez started playing Ric Pa (Sun Aug 05 2001 - 19:07:54 PDT)
    • Re: Now the kiddiez started playing Patrick Oonk (Mon Aug 06 2001 - 01:03:54 PDT)
    • Re: Now the kiddiez started playing macdaddyat_private (Sun Aug 05 2001 - 21:01:05 PDT)
  • Re: Now the kiddiez started playing Nick FitzGerald (Mon Aug 06 2001 - 22:12:39 PDT)
• Re: CR vs. CoreBuilder terry white (Sun Aug 05 2001 - 15:57:11 PDT)
  • Re: CR vs. CoreBuilder randy (Sun Aug 05 2001 - 20:46:24 PDT)
    • Re: CR vs. CoreBuilder dep (Sun Aug 05 2001 - 22:00:49 PDT)
  • Re: CR vs. CoreBuilder randy (Sun Aug 05 2001 - 20:46:24 PDT)
  • Re: CR vs. CoreBuilder GraffiX (Sun Aug 05 2001 - 21:58:51 PDT)
    • Re: CR vs. CoreBuilder Bryan Andersen (Mon Aug 06 2001 - 10:56:58 PDT)
    • Re: CR vs. CoreBuilder Homer Wilson Smith (Mon Aug 06 2001 - 09:53:17 PDT)
  • Re: CR vs. CoreBuilder cordsat_private-frankfurt.de (Mon Aug 06 2001 - 05:22:29 PDT)
  • RE: CR vs. CoreBuilder Curt Purdy (Mon Aug 06 2001 - 10:54:38 PDT)
    • Re: CR vs. CoreBuilder John Hall (Thu Aug 09 2001 - 12:57:19 PDT)
  • Re: CR vs. CoreBuilder cordsat_private-frankfurt.de (Mon Aug 06 2001 - 05:22:29 PDT)
• What use is the NIPC? aleph1at_private (Sun Aug 05 2001 - 17:07:13 PDT)
  • Re: What use is the NIPC? bonkat_private (Sun Aug 05 2001 - 18:33:03 PDT)
    • Re: What use is the NIPC? / RFF Comments Richard Forno (Sun Aug 05 2001 - 16:40:58 PDT)
  • Re: What use is the NIPC? Jay D. Dyson (Mon Aug 06 2001 - 01:48:05 PDT)
  • RE: What use is the NIPC? Tim Hollebeek (Mon Aug 06 2001 - 11:36:55 PDT)
• Worm Attack Rate aleph1at_private (Sun Aug 05 2001 - 17:19:14 PDT)
  • RE: Worm Attack Rate Miles Sabin (Mon Aug 06 2001 - 04:26:15 PDT)
  • Re: Worm Attack Rate Paul Cardon (Mon Aug 06 2001 - 12:18:39 PDT)
• Want to write a disinfection tool? aleph1at_private (Sun Aug 05 2001 - 18:11:00 PDT)
  • Re: Want to write a disinfection tool? L. Christopher Paul (Sun Aug 05 2001 - 19:24:11 PDT)
    • Re: Want to write a disinfection tool? aleph1at_private (Sun Aug 05 2001 - 19:28:35 PDT)
• Yet Another Worm ??? David Brown (Sun Aug 05 2001 - 17:52:29 PDT)
• CRv2 multiple scans from same source IP John Davidson (Sun Aug 05 2001 - 17:39:14 PDT)
  • Re: CRv2 multiple scans from same source IP Luc Pardon (Sun Aug 05 2001 - 20:02:05 PDT)
    • Re: CRv2 multiple scans from same source IP Chris Freeze (Sun Aug 05 2001 - 20:25:08 PDT)
  • Re: CRv2 multiple scans from same source IP Chris Freeze (Sun Aug 05 2001 - 19:58:19 PDT)
    • RE: CRv2 multiple scans from same source IP Gareth Hastings (Mon Aug 06 2001 - 02:29:00 PDT)
    • Re: CRv2 multiple scans from same source IP Paul Gear (Mon Aug 06 2001 - 13:33:00 PDT)
  • Re: CRv2 multiple scans from same source IP Valdis.Kletnieksat_private (Sun Aug 05 2001 - 20:23:00 PDT)
  • RE: CRv2 multiple scans from same source IP robhat_private (Sun Aug 05 2001 - 21:00:15 PDT)
  • Re: CRv2 multiple scans from same source IP corecode (Mon Aug 06 2001 - 03:09:12 PDT)
    • Re: CRv2 multiple scans from same source IP Lee Smith (Mon Aug 06 2001 - 12:15:10 PDT)
      • RE: CRv2 multiple scans from same source IP Andrew Cruse (Mon Aug 06 2001 - 13:46:52 PDT)
    • Re: CRv2 multiple scans from same source IP Ryan Russell (Mon Aug 06 2001 - 12:23:13 PDT)
      • Re: CRv2 multiple scans from same source IP Andy Berkheimer (Mon Aug 06 2001 - 13:51:52 PDT)
      • Re: CRv2 multiple scans from same source IP corecode (Mon Aug 06 2001 - 14:39:36 PDT)
    • Re: CRv2 multiple scans from same source IP Bryan Andersen (Mon Aug 06 2001 - 12:33:04 PDT)
  • RE: CRv2 multiple scans from same source IP Tim Hollebeek (Mon Aug 06 2001 - 13:19:47 PDT)
  • RE: CRv2 multiple scans from same source IP corecode (Mon Aug 06 2001 - 13:35:04 PDT)
• CodeRedII variant - smaller size now? Deterding, Brent D (Sun Aug 05 2001 - 21:42:48 PDT)
• CodeRedII attempts from Cable/DSL/dial-ups Ben N. Venzke (Sun Aug 05 2001 - 23:19:59 PDT)
  • RE: CodeRedII attempts from Cable/DSL/dial-ups Thomas Frerichs (Sun Aug 05 2001 - 22:06:56 PDT)
    • Re: PWS was: CodeRedII attempts from Cable/DSL/dial-ups Gary Flynn (Mon Aug 06 2001 - 09:34:36 PDT)
    • RE: CodeRedII attempts from Cable/DSL/dial-ups Derek Kwan (Mon Aug 06 2001 - 08:54:26 PDT)
  • RE: CodeRedII attempts from Cable/DSL/dial-ups Srdjan Nikolic (Mon Aug 06 2001 - 01:39:12 PDT)
  • Re: CodeRedII attempts from Cable/DSL/dial-ups Guilherme Mesquita (Mon Aug 06 2001 - 12:25:04 PDT)
• Code Red honeypot + SMTP logger/alerter Chad Loder (Sun Aug 05 2001 - 21:20:57 PDT)
• 'Double' hits with CodeRedII Sven Carstens (Mon Aug 06 2001 - 03:30:35 PDT)
• CR Overflows followed up by UDP 2380 Thompson, John J (Mon Aug 06 2001 - 07:06:19 PDT)
  • Re: CR Overflows followed up by UDP 2380 Alfred Huger (Mon Aug 06 2001 - 10:11:35 PDT)
• scan CodeRed II infected servers pilot (Mon Aug 06 2001 - 08:52:43 PDT)
• Bad CodeRed request ? Rodrigo Barbosa (Mon Aug 06 2001 - 09:10:15 PDT)
  • Re: Bad CodeRed request ? Ryan Russell (Mon Aug 06 2001 - 11:06:07 PDT)
  • Re: Bad CodeRed request ? Tim Walberg (Mon Aug 06 2001 - 11:26:23 PDT)
  • Re: Bad CodeRed request ? corecode (Mon Aug 06 2001 - 11:21:48 PDT)
• Infected IP addresses Alfred Huger (Mon Aug 06 2001 - 11:05:54 PDT)
• STRANGE CodeRedII packets from only one host Deterding, Brent D (Mon Aug 06 2001 - 08:35:32 PDT)
• Method to Clean up IIS servers hit by CRv2 dmuz (Mon Aug 06 2001 - 11:23:56 PDT)
  • Re: Method to Clean up IIS servers hit by CRv2 Ralph Mellor (Mon Aug 06 2001 - 11:27:22 PDT)
  • RE: Method to Clean up IIS servers hit by CRv2 Doug.Barbinat_private (Mon Aug 06 2001 - 11:57:29 PDT)
  • RE: Method to Clean up IIS servers hit by CRv2 Walling, Ken (Mon Aug 06 2001 - 14:32:57 PDT)
• RE: disinfection tool Mark Ng (Mon Aug 06 2001 - 05:19:52 PDT)
  • Re: disinfection tool Alfred Huger (Mon Aug 06 2001 - 11:39:06 PDT)
    • RE: disinfection tool Ken Pfeil (Mon Aug 06 2001 - 12:41:21 PDT)
    • Re: disinfection tool Homer Wilson Smith (Mon Aug 06 2001 - 12:43:32 PDT)
      • Re: disinfection tool Ryan Russell (Mon Aug 06 2001 - 13:35:59 PDT)
  • RE: disinfection tool Rob McCauley (Mon Aug 06 2001 - 12:13:32 PDT)
• Was RE: disinfection tool -- now a minor rant. Mark Challender (Mon Aug 06 2001 - 12:05:21 PDT)
  • Re: Was RE: disinfection tool -- now a minor rant. H C (Mon Aug 06 2001 - 13:52:20 PDT)
    • Re: Was RE: disinfection tool -- now a minor rant. Jim (Mon Aug 06 2001 - 15:38:17 PDT)
  • RE: Was RE: disinfection tool -- now a minor rant. Marc Maiffret (Mon Aug 06 2001 - 13:24:27 PDT)
  • RE: Was RE: disinfection tool -- now a minor rant. Tony Langdon (Tue Aug 07 2001 - 17:01:37 PDT)
• So Many Requests! Richard Hill (Mon Aug 06 2001 - 13:22:49 PDT)
• Symantec Report rl (Mon Aug 06 2001 - 13:53:48 PDT)
  • Why can't "experts" get it right? (Was Re: Symantec Report) Ralph Mellor (Mon Aug 06 2001 - 14:53:28 PDT)
• more Code Red analysis robert_david_graham (Mon Aug 06 2001 - 16:57:30 PDT)
  • RE: more Code Red analysis Marc Maiffret (Tue Aug 07 2001 - 11:04:59 PDT)
  • Re: more Code Red analysis Ralph Mellor (Tue Aug 07 2001 - 12:42:00 PDT)
• Code Red II - Dead Thread Alfred Huger (Tue Aug 07 2001 - 09:26:56 PDT)
  • Re: Code Red II - Dead Thread Dave Laird (Tue Aug 07 2001 - 10:22:32 PDT)
  • RE: Code Red II - Dead Thread Steve Halligan (Wed Aug 08 2001 - 07:16:22 PDT)
• Trojan in Aide distribution at ftp.linux.hr Rami Lehti (Mon Aug 06 2001 - 23:45:42 PDT)
• Microsoft support Ralph Mellor (Tue Aug 07 2001 - 14:01:10 PDT)
• Unsuspected "named" behaviour Gustav (Tue Aug 07 2001 - 10:18:13 PDT)
  • Re: Unsuspected "named" behaviour dewt (Tue Aug 07 2001 - 15:31:04 PDT)
    • Java 1.1.8 paired probes Jackie (Thu Aug 16 2001 - 07:00:52 PDT)
      • RE: Java 1.1.8 paired probes NESTING, DAVID M (SBCSI) (Fri Aug 17 2001 - 11:26:36 PDT)
• CR2 Incident - root.exe present, but explorer.exe process not? Bartel, Matt (Tue Aug 07 2001 - 12:40:59 PDT)
• UDP scans from CodeRed-infected hosts Kyle Maus (Tue Aug 07 2001 - 12:29:57 PDT)
  • RE: UDP scans from CodeRed-infected hosts Tony Langdon (Tue Aug 07 2001 - 20:13:07 PDT)
• NEW DEVELOPMENT -- Attempts at using CodeRed II systems to perform Denial of Service Attacks and Possible Attacking Tool Eyes to the Skies. (Tue Aug 07 2001 - 14:30:16 PDT)
  • Re: NEW DEVELOPMENT -- Attempts at using CodeRed II systems to perform Denial of Service Attacks and Possible Attacking Tool Blake Frantz (Tue Aug 07 2001 - 16:32:54 PDT)
  • Re: NEW DEVELOPMENT -- Attempts at using CodeRed II systems to perform Denial of Service Attacks and Possible Attacking Tool Ryan Russell (Tue Aug 07 2001 - 18:07:11 PDT)
    • "Power" bot (was Re: NEW DEVELOPMENT -- Attempts at using CodeRed II systems to perform Denial of Service Attacks and Possible Attacking Tool) Dave Dittrich (Wed Aug 08 2001 - 12:41:55 PDT)
• New Method for Blocking Code Red and Similar Exploits Randall S. Benn (Tue Aug 07 2001 - 15:31:01 PDT)
  • Re: New Method for Blocking Code Red and Similar Exploits Nelson Neves (Tue Aug 07 2001 - 22:07:23 PDT)
  • Re: New Method for Blocking Code Red and Similar Exploits Antonio Vasconcelos (Tue Aug 07 2001 - 19:46:55 PDT)
  • RE: New Method for Blocking Code Red and Similar Exploits Mike Batchelor (Wed Aug 08 2001 - 15:10:36 PDT)
• Port scans from CodeRed-infected hosts Kyle Maus (Wed Aug 08 2001 - 08:09:32 PDT)
• port 80 and sunrpc (111) Robert (Tue Aug 07 2001 - 19:04:45 PDT)
• CodeRed - simple attacks analyzer Daniel Kiper (Wed Aug 08 2001 - 04:29:40 PDT)
• W2K UDP Based DDoS Trojan Daniel G. Epstein (Tue Aug 07 2001 - 18:57:55 PDT)
• MS tool to disinfect Code Red II aleph1at_private (Tue Aug 07 2001 - 21:32:31 PDT)
  • RE: MS tool to disinfect Code Red II David LeBlanc (Wed Aug 08 2001 - 14:41:51 PDT)
• Re: Code Red, Virus Growth, and some misunderstandings Thomas Roessler (Wed Aug 08 2001 - 04:43:02 PDT)
• RE: Code Red, ARP and YOU!! Hoyt Plunkett (Wed Aug 08 2001 - 10:28:29 PDT)
  • RE: Code Red, ARP and YOU!! Chad Loder (Wed Aug 08 2001 - 14:05:58 PDT)
• Personal stats on satx.rr.com ARP traffic Richard Bejtlich (Tue Aug 07 2001 - 20:29:26 PDT)
• Increase in DNS traffic? kath (Tue Aug 07 2001 - 20:49:50 PDT)
  • Re: Increase in DNS traffic? Simon Delicata (Wed Aug 08 2001 - 11:49:44 PDT)
  • Re: Increase in DNS traffic? measlat_private (Wed Aug 08 2001 - 13:36:45 PDT)
• Code Red affects patched IIS4 servers with URL redirection Jean-Francois Prieur (Wed Aug 08 2001 - 05:04:55 PDT)
• CR - inetinfo - tool to show number of processes Soeren Ziehe (Wed Aug 08 2001 - 13:20:00 PDT)
  • RE: CR - inetinfo - tool to show number of processes Black, Braden (Wed Aug 08 2001 - 15:11:19 PDT)
• CodeRed, the Media, and people E. Larry Lidz (Wed Aug 08 2001 - 11:12:41 PDT)
  • Cisco Router and NBAR Jason Robertson (Thu Aug 09 2001 - 12:03:49 PDT)
    • Re: Cisco Router and NBAR Lisa Napier (Fri Aug 10 2001 - 16:35:49 PDT)
• Early Bird: A realtime Code Red attempt reporting utility. Jay D. Dyson (Thu Aug 09 2001 - 02:34:51 PDT)
• (forw) "Power" bot (was Re: NEW DEVELOPMENT -- Attempts at using CodeRed II systems to perform Denial of Service Attacks and Possible Attacking Tool) (fwd) Alfred Huger (Thu Aug 09 2001 - 09:46:46 PDT)
• Code Red(s) being confused with sadmind/IIS worm? Stephen W. Thompson (Thu Aug 09 2001 - 14:09:40 PDT)
  • Re: [unisog] Code Red(s) being confused with sadmind/IIS worm? Anderson Johnston (Thu Aug 09 2001 - 15:31:52 PDT)
  • Re: Code Red(s) being confused with sadmind/IIS worm? ghandiat_private (Thu Aug 09 2001 - 17:28:14 PDT)
  • Re: [unisog] Code Red(s) being confused with sadmind/IIS worm? Paul L Schmehl (Thu Aug 09 2001 - 16:25:08 PDT)
  • Re: Code Red(s) being confused with sadmind/IIS worm? H C (Thu Aug 09 2001 - 16:31:03 PDT)
• DHCP, ARP, oh my Anyone know of an exploit that dupes ARP on wind ows 95? Reeves, Michael (GEAE, Compaq) (Thu Aug 09 2001 - 06:29:19 PDT)
• Possible way to avoid unknown IIS vulnerabilities Mark A Lewis (Wed Aug 08 2001 - 23:31:10 PDT)
  • RE: Possible way to avoid unknown IIS vulnerabilities Michael Katz (Thu Aug 09 2001 - 22:20:19 PDT)
    • Re: Possible way to avoid unknown IIS vulnerabilities Mike Lewinski (Fri Aug 10 2001 - 08:01:03 PDT)
• Code Red II inspired by both Code Red and sadmind/IIS Denis Normand (Wed Aug 08 2001 - 19:25:40 PDT)
  • Re: Code Red II inspired by both Code Red and sadmind/IIS Nick FitzGerald (Fri Aug 10 2001 - 05:40:47 PDT)
• port 80 scans under cover of code red Russell Fulton (Wed Aug 08 2001 - 21:25:01 PDT)
• RE: Defaced Reverend Lola (Thu Aug 09 2001 - 10:30:04 PDT)
• Code Red Doesn't care about TCP sessions? Mark Wiater (Thu Aug 09 2001 - 09:27:02 PDT)
  • Re: Code Red Doesn't care about TCP sessions? Vern Paxson (Thu Aug 09 2001 - 21:36:47 PDT)
    • Re: Code Red Doesn't care about TCP sessions? Mark Wiater (Fri Aug 10 2001 - 06:52:55 PDT)
      • R: Code Red Doesn't care about TCP sessions? Giovanni Bobbio (Fri Aug 10 2001 - 08:24:25 PDT)
  • Re: Code Red Doesn't care about TCP sessions? rottzat_private (Thu Aug 09 2001 - 16:03:40 PDT)
  • RE: Code Red Doesn't care about TCP sessions? David LeBlanc (Fri Aug 10 2001 - 12:24:01 PDT)
• Looking for a better scanner for CodeRed Reeves, Michael (GEAE, Compaq) (Thu Aug 09 2001 - 11:10:46 PDT)
  • Re: Looking for a better scanner for CodeRed Security (Fri Aug 10 2001 - 04:43:28 PDT)
  • RE: Looking for a better scanner for CodeRed Aviram Jenik (Fri Aug 10 2001 - 06:28:18 PDT)
  • Looking for a better scanner for CodeRed Reeves, Michael (GEAE, Compaq) (Fri Aug 10 2001 - 08:24:55 PDT)
• Re: Possible trojaned wlogon.exe? Paul Dokas (Wed Aug 08 2001 - 13:36:07 PDT)
• CodeRed II Mutants John Davidson (Wed Aug 08 2001 - 14:11:09 PDT)
• Re: DHCP, ARP, oh my Anyone know of an exploit that dupes ARP o Rocky Jenkins (Thu Aug 09 2001 - 15:55:09 PDT)
• C o d e R e d Stats script Jason Brvenik (Thu Aug 09 2001 - 21:58:02 PDT)
• Antw: Looking for a better scanner for CodeRed Milan Goellner (Fri Aug 10 2001 - 03:11:53 PDT)
• RE: DHCP, ARP, oh my Anyone know of an exploit that dupes ARP on wind ows 95? Joseph Spears (Thu Aug 09 2001 - 15:39:46 PDT)
• Re: Personal stats on comp.glam.ac.uk traffic John Sage (Fri Aug 10 2001 - 08:49:47 PDT)
• Re: CodeRed II Mutants - not Stephen Friedl (Fri Aug 10 2001 - 07:50:23 PDT)
  • Re: CodeRed II Mutants - not Denis Ducamp (Fri Aug 10 2001 - 13:52:40 PDT)
• What the *** is this Steve Halligan (Fri Aug 10 2001 - 11:02:04 PDT)
  • Re: What the *** is this Ryan Russell (Fri Aug 10 2001 - 13:13:38 PDT)
  • Re: What the *** is this Nick FitzGerald (Fri Aug 10 2001 - 15:00:41 PDT)
  • Re: What the *** is this dmuz (Fri Aug 10 2001 - 13:16:42 PDT)
  • Re: What the *** is this Justin Shore (Fri Aug 10 2001 - 13:15:29 PDT)
• CodeRed Scanner and IIS vulnerabilities check pilot (Fri Aug 10 2001 - 11:10:24 PDT)
• [Fwd: Hotmail message malware] Blue Boar (Fri Aug 10 2001 - 11:54:20 PDT)
• apache custom logging for code red requests-a solution Adrian Ciobanu (Fri Aug 10 2001 - 14:21:13 PDT)
• Variant that hits more than c: and d:??? David LeBlanc (Fri Aug 10 2001 - 18:18:36 PDT)
• [klmtfsat_private: Your Online Greeting Awaits You!] diphenat_private (Sun Aug 12 2001 - 02:05:08 PDT)
  • Re: [klmtfsat_private: Your Online Greeting Awaits You!] Mark Collins (Sun Aug 12 2001 - 13:39:47 PDT)
  • Re: [klmtfsat_private: Your Online Greeting Awaits You!] Jay D. Dyson (Sun Aug 12 2001 - 13:58:28 PDT)
  • RE: [klmtfsat_private: Your Online Greeting Awaits You!] Jay D. Dyson (Sun Aug 12 2001 - 18:45:29 PDT)
  • Re: [klmtfsat_private: Your Online Greeting Awaits You!] freeholdat_private (Sun Aug 12 2001 - 20:34:26 PDT)
  • Re: [klmtfsat_private: Your Online Greeting Awaits You!] Brett Glass (Mon Aug 13 2001 - 12:15:02 PDT)
• hideit.pl hides any program from ps?! Richard Collins (Sun Aug 12 2001 - 11:08:12 PDT)
• IKE /HTTP exploit??? Dean Cunningham (Sun Aug 12 2001 - 16:48:54 PDT)
  • RE: IKE /HTTP exploit??? Dean Cunningham (Sun Aug 12 2001 - 17:46:52 PDT)
• for all those wondering - CRII has a bug! corecode (Sun Aug 12 2001 - 16:47:32 PDT)
• Been a victim of a DDoS Gustavo Monserrat (Mon Aug 13 2001 - 07:31:06 PDT)
  • Re: Been a victim of a DDoS Vitaly Osipov (Tue Aug 14 2001 - 01:31:10 PDT)
  • Re: Been a victim of a DDoS Gustavo Monserrat (Wed Aug 15 2001 - 07:46:08 PDT)
• Do you know any Day 0 hacks use port 139? (fwd) Derek Kwan (Mon Aug 13 2001 - 12:27:09 PDT)
  • Re: Do you know any Day 0 hacks use port 139? (fwd) Blake McNeill (Mon Aug 13 2001 - 14:01:33 PDT)
    • Re: Do you know any Day 0 hacks use port 139? (fwd) Jason Spence (Mon Aug 20 2001 - 18:07:16 PDT)
      • Re: Do you know any Day 0 hacks use port 139? (fwd) Blake McNeill (Mon Aug 20 2001 - 19:08:37 PDT)
• MSIIS servers patched/de-doored, but C and D keep coming back Garreth Jeremiah/Markham/IBM (Mon Aug 13 2001 - 13:27:35 PDT)
  • Re: MSIIS servers patched/de-doored, but C and D keep coming back Russell Fulton (Mon Aug 13 2001 - 15:22:20 PDT)
  • RE: MSIIS servers patched/de-doored, but C and D keep coming back Garreth Jeremiah/Markham/IBM (Mon Aug 13 2001 - 16:17:55 PDT)
  • RE: MSIIS servers patched/de-doored, but C and D keep coming back Mike Horne (Mon Aug 13 2001 - 17:58:14 PDT)
  • Re: MSIIS servers patched/de-doored, but C and D keep coming back K P (Mon Aug 13 2001 - 17:27:44 PDT)
    • Re: MSIIS servers patched/de-doored, but C and D keep coming back Gary Flynn (Tue Aug 14 2001 - 11:42:17 PDT)
  • RE: MSIIS servers patched/de-doored, but C and D keep coming back Krull, Chris (Tue Aug 14 2001 - 09:20:42 PDT)
  • RE: MSIIS servers patched/de-doored, but C and D keep coming back Davis, Matt (Tue Aug 14 2001 - 11:03:03 PDT)
• Appeal for Help. NOT Code Red But Is It? Lindley, Patrick@HHSDC (Mon Aug 13 2001 - 13:41:49 PDT)
  • Re: Appeal for Help. NOT Code Red But Is It? Bryan Andersen (Mon Aug 13 2001 - 22:57:47 PDT)
  • Re: Appeal for Help. NOT Code Red But Is It? Ryan Russell (Wed Aug 15 2001 - 22:07:41 PDT)
• Scripted CodeRed2 reply Chris Curtiss (Tue Aug 14 2001 - 06:57:09 PDT)
  • RE: Scripted CodeRed2 reply Baker, Thomas (Tue Aug 14 2001 - 11:29:58 PDT)
• Code Red II hit in July??? Booke, Raymond (Mon Aug 13 2001 - 16:15:19 PDT)
  • Re: Code Red II hit in July??? Ryan Russell (Tue Aug 14 2001 - 12:31:10 PDT)
• tamersahin.net Code Red Cleaner v1.0 Tamer Sahin (Tue Aug 14 2001 - 02:24:04 PDT)
  • Re: tamersahin.net Code Red Cleaner v1.0 Tamer Sahin (Tue Aug 14 2001 - 15:08:05 PDT)
• Very thorough scan of web apps- jamie rishaw (Tue Aug 14 2001 - 11:09:53 PDT)
  • Re: Very thorough scan of web apps- Hugo van der Kooij (Tue Aug 14 2001 - 16:10:16 PDT)
  • Re: Very thorough scan of web apps- J Jewitt (Wed Aug 15 2001 - 07:48:30 PDT)
• Fwd: of offending. dep (Tue Aug 14 2001 - 15:49:14 PDT)
  • Re: Fwd: of offending. Luc Pardon (Tue Aug 14 2001 - 20:19:56 PDT)
  • RE: Fwd: of offending. Dean Cunningham (Wed Aug 15 2001 - 14:40:40 PDT)
• IDS Tool Alfred Huger (Tue Aug 14 2001 - 16:21:17 PDT)
• Hacker Tools and their Signatures, Part Three: Rootkits Alfred Huger (Wed Aug 15 2001 - 09:40:51 PDT)
  • Hacker Tools and their Signatures, Part Three: Rootkits Alfred Huger (Wed Aug 15 2001 - 09:40:51 PDT)
• scans for root.exe Kevin Holmquist (Wed Aug 15 2001 - 21:14:09 PDT)
  • Re: scans for root.exe David Pick (Thu Aug 16 2001 - 08:00:50 PDT)
    • Re: scans for root.exe Jacek Lipkowski (Thu Aug 16 2001 - 08:36:00 PDT)
      • Re: scans for root.exe Daniel Harrison (Thu Aug 16 2001 - 09:22:03 PDT)
      • Re: scans for root.exe Christian Kuhtz (Thu Aug 16 2001 - 09:34:09 PDT)
      • Re: scans for root.exe Daniel Harrison (Thu Aug 16 2001 - 10:51:35 PDT)
• Possible scan? Erik Benner (Thu Aug 16 2001 - 17:25:33 PDT)
  • Re: Possible scan? Greg Owen (Fri Aug 17 2001 - 13:49:19 PDT)
• Flash Worms Stuart Staniford (Thu Aug 16 2001 - 17:48:17 PDT)
  • Re: Flash Worms Michal Zalewski (Fri Aug 17 2001 - 11:56:42 PDT)
    • Re: Flash Worms Stuart Staniford (Fri Aug 17 2001 - 13:55:24 PDT)
      • Re: Flash Worms Michal Zalewski (Fri Aug 17 2001 - 17:11:24 PDT)
      • Re: Flash Worms jaywhy (Sat Aug 18 2001 - 10:15:45 PDT)
      • Re: Flash Worms Dragos Ruiu (Sat Aug 18 2001 - 11:08:14 PDT)
      • Re: Flash Worms Shoten (Wed Aug 22 2001 - 12:32:26 PDT)
      • Re: Flash Worms Kevin Reardon (Thu Aug 23 2001 - 17:13:07 PDT)
      • Re: Flash Worms Stuart Staniford (Wed Aug 22 2001 - 11:57:15 PDT)
      • Re: Flash Worms Bruno Treguier (Tue Aug 21 2001 - 09:08:03 PDT)
      • Re: Flash Worms Kevin Reardon (Tue Aug 21 2001 - 12:51:07 PDT)
    • Re: Flash Worms Robert Graham (Fri Aug 17 2001 - 15:32:41 PDT)
      • Re: Flash Worms Jose Nazario (Sun Aug 19 2001 - 16:20:15 PDT)
      • Flash Worms and congestion Stuart Staniford (Wed Aug 22 2001 - 13:51:48 PDT)
  • Re: Flash Worms Vern Paxson (Wed Aug 22 2001 - 00:31:17 PDT)
• backdoor in freebsd found.. Renee Teunissen (Sat Aug 18 2001 - 05:25:45 PDT)
  • Re: backdoor in freebsd found.. Rainer Weikusat (Sun Aug 19 2001 - 04:38:39 PDT)
• annoying ftp probes Emil Popov (Mon Aug 20 2001 - 03:33:03 PDT)
  • smtp probes Eduardo Cruz (Mon Aug 20 2001 - 08:38:43 PDT)
    • Re: smtp probes Hugo van der Kooij (Mon Aug 20 2001 - 13:54:55 PDT)
      • Re: smtp probes Wichert Akkerman (Mon Aug 20 2001 - 16:55:24 PDT)
  • Re: annoying ftp probes Jason Spence (Mon Aug 20 2001 - 11:20:08 PDT)
    • Re: annoying ftp probes Mike Eheler (Mon Aug 20 2001 - 05:22:10 PDT)
  • RE: annoying ftp probes Mark Villanova (Mon Aug 20 2001 - 12:28:00 PDT)
    • RE: annoying ftp probes Gregory McCann (Mon Aug 20 2001 - 13:26:48 PDT)
      • RE: annoying ftp probes Skeeve Stevens (Sun Aug 26 2001 - 03:37:31 PDT)
  • RE: annoying ftp probes NESTING, DAVID M (SBCSI) (Mon Aug 20 2001 - 12:50:57 PDT)
  • Re: annoying ftp probes Joris De Donder (Mon Aug 20 2001 - 12:34:14 PDT)
  • Re: annoying ftp probes Emil Popov (Mon Aug 27 2001 - 04:20:15 PDT)
• What if CodeRed encoded it's HTTP requests? Nuno Mendes (Mon Aug 20 2001 - 05:27:17 PDT)
  • Re: What if CodeRed encoded it's HTTP requests? Ryan Russell (Mon Aug 20 2001 - 08:52:51 PDT)
  • Re: What if CodeRed encoded it's HTTP requests? Jose Nazario (Mon Aug 20 2001 - 08:39:40 PDT)
• Beta Testers Needed, Part II Alfred Huger (Mon Aug 20 2001 - 10:26:23 PDT)
• Infosec professionals in New England? Jeffery L. Stutzman (Tue Aug 21 2001 - 09:14:31 PDT)
• odd host scans to random addressess Russell Fulton (Tue Aug 21 2001 - 16:11:20 PDT)
• Large scale scan of port 2401 Aaron (Tue Aug 21 2001 - 16:55:43 PDT)
• 24 hour strobes from 10.0.x.x Konrad Michels (Wed Aug 22 2001 - 04:53:04 PDT)
  • RE: 24 hour strobes from 10.0.x.x Graham Bignell (Wed Aug 22 2001 - 11:05:49 PDT)
    • Re: 24 hour strobes from 10.0.x.x Konrad Michels (Thu Aug 23 2001 - 01:05:55 PDT)
• New CodeRed variant - CodeRed.d David Kennedy CISSP (Tue Aug 21 2001 - 21:24:51 PDT)
  • Re: New CodeRed variant - CodeRed.d Ryan Russell (Wed Aug 22 2001 - 11:18:37 PDT)
• strange .lnk file in email. J. J. Horner (Wed Aug 22 2001 - 08:07:54 PDT)
  • Re: strange .lnk file in email. Michal 'CeFeK' Nazarewicz (Wed Aug 22 2001 - 11:16:57 PDT)
  • RE: strange .lnk file in email. Richard Stanway (Wed Aug 22 2001 - 10:50:47 PDT)
• Revenue loss due to breakins Reeves, Michael (GEAE, Compaq) (Wed Aug 22 2001 - 10:45:58 PDT)
  • RE: Revenue loss due to breakins Reeves, Michael (GEAE, Compaq) (Wed Aug 22 2001 - 13:44:34 PDT)
  • Re: Revenue loss due to breakins JohnNicholsonat_private (Wed Aug 22 2001 - 13:38:10 PDT)
    • Re: Revenue loss due to breakins Big Woz (Thu Aug 23 2001 - 11:33:42 PDT)
      • RE: Revenue loss due to breakins Thomas Frerichs (Thu Aug 23 2001 - 15:42:38 PDT)
  • Re: Revenue loss due to breakins Stephen Friedl (Thu Aug 23 2001 - 11:02:55 PDT)
  • Re: Revenue loss due to breakins daniel heinonen (Thu Aug 23 2001 - 16:19:07 PDT)
  • RE: Revenue loss due to breakins Mark Challender (Fri Aug 24 2001 - 12:52:20 PDT)
• Strange Scans (dst host == dst port) Scott Nursten (Thu Aug 23 2001 - 02:39:12 PDT)
• Intrusion reported on NANOG Mike Lewinski (Thu Aug 23 2001 - 10:09:29 PDT)
• Re : Large scale scan of port 2401 axess (Thu Aug 23 2001 - 10:04:44 PDT)
  • Re: Re : Large scale scan of port 2401 John Marquart (Thu Aug 23 2001 - 11:17:21 PDT)
    • Re: Re : Large scale scan of port 2401 axess (Thu Aug 23 2001 - 11:31:40 PDT)
  • Re: Re : Large scale scan of port 2401 Sevo Stille (Fri Aug 24 2001 - 05:40:03 PDT)
    • Re: [incidents] Re: Re : Large scale scan of port 2401 David Bronder (Fri Aug 24 2001 - 13:37:25 PDT)
    • Re: Re : Large scale scan of port 2401 axess (Fri Aug 24 2001 - 14:03:15 PDT)
      • Re: AIX writesrv on port 2401 Troy Bollinger (Fri Aug 31 2001 - 08:26:47 PDT)
• Smurf Broadcast DoS attack X (Thu Aug 23 2001 - 03:35:14 PDT)
  • Re: Smurf Broadcast DoS attack Valdis.Kletnieksat_private (Thu Aug 23 2001 - 11:38:14 PDT)
  • Re: Smurf Broadcast DoS attack Avleen Vig (Fri Aug 24 2001 - 07:46:06 PDT)
• Code Red - A Possible Origin? Michael J. Cannon (Wed Aug 22 2001 - 14:11:18 PDT)
  • RE: Code Red - A Possible Origin? Michal Nazarewicz (Fri Aug 24 2001 - 00:42:17 PDT)
    • Re: Code Red - A Possible Origin? Mike Lewinski (Fri Aug 24 2001 - 13:09:12 PDT)
      • Re: Code Red - A Possible Origin? Michael J. Cannon (Mon Aug 27 2001 - 15:55:56 PDT)
      • Re: Code Red - A Possible Origin? Ben Okopnik (Wed Aug 29 2001 - 12:05:42 PDT)
    • Re: Code Red - A Possible Origin? Michael J. Cannon (Fri Aug 24 2001 - 13:22:19 PDT)
  • Re: Code Red - A Possible Origin? SVaterat_private (Thu Aug 30 2001 - 12:35:54 PDT)
    • Re: Code Red - A Possible Origin? Michael J. Cannon (Thu Aug 30 2001 - 13:24:02 PDT)
  • Re: Code Red - A Possible Origin? Joshua Hirsh (Fri Aug 31 2001 - 07:40:25 PDT)
    • Re: Code Red - A Possible Origin? Michael J. Cannon (Fri Aug 31 2001 - 09:58:05 PDT)
• Identification needed ... Neil Dickey (Mon Aug 27 2001 - 12:11:02 PDT)
  • RE: Identification needed ... Reeves, Michael (GEAE, Compaq) (Mon Aug 27 2001 - 13:03:48 PDT)
• Everything and the kitchen sink. Sebastian Ip (Sat Aug 25 2001 - 20:07:03 PDT)
  • Re: Everything and the kitchen sink. Hugo van der Kooij (Mon Aug 27 2001 - 14:22:53 PDT)
• Weird Incoming IP's and port numbers. West P. (Sun Aug 26 2001 - 19:21:01 PDT)
  • Re: Weird Incoming IP's and port numbers. Hugo van der Kooij (Mon Aug 27 2001 - 14:18:51 PDT)
  • Re: Weird Incoming IP's and port numbers. West P. (Mon Aug 27 2001 - 18:52:10 PDT)
  • RE: Weird Incoming IP's and port numbers. NESTING, DAVID M (SBCSI) (Mon Aug 27 2001 - 14:47:43 PDT)
  • RE: Weird Incoming IP's and port numbers. Vachon, Scott (Tue Aug 28 2001 - 05:40:46 PDT)
  • RE: Weird Incoming IP's and port numbers. NESTING, DAVID M (SBCSI) (Wed Aug 29 2001 - 08:43:44 PDT)
• Teddi Trojan - New? Dean Cunningham (Sun Aug 26 2001 - 14:41:37 PDT)
• icqsrp.exe Wolf Knox Seandor La-Vey (Sun Aug 26 2001 - 11:52:19 PDT)
• Code Red - Kind of interesting actually Keith Pachulski (Mon Aug 27 2001 - 13:15:29 PDT)
• CBOS v2.4.3 terry white (Sat Aug 25 2001 - 07:53:34 PDT)
• nbsession scans Ray Beaulieu (Tue Aug 28 2001 - 09:01:08 PDT)
  • Re: nbsession scans H C (Wed Aug 29 2001 - 08:37:23 PDT)
• solaris lpd, KARMAPOLICE? Ricky Vludmore (Wed Aug 29 2001 - 01:47:26 PDT)
  • Re: solaris lpd, KARMAPOLICE? Ken K (Wed Aug 29 2001 - 13:22:22 PDT)
  • Re: solaris lpd, KARMAPOLICE? Ricky Vludmore (Wed Aug 29 2001 - 21:13:26 PDT)
• Re: CodeRed Snort Rules Nick FitzGerald (Wed Aug 29 2001 - 16:19:16 PDT)
• new codered worm? ^^ sang sang (Wed Aug 29 2001 - 19:12:43 PDT)
  • Re: new codered worm? Nick FitzGerald (Thu Aug 30 2001 - 13:39:35 PDT)
  • Re: new codered worm? Ryan Russell (Thu Aug 30 2001 - 13:32:26 PDT)
• ntoskrnl.exe issue R M (Thu Aug 30 2001 - 03:05:06 PDT)
  • Re: ntoskrnl.exe issue Chuq Yang (Thu Aug 30 2001 - 10:43:40 PDT)
  • Re: ntoskrnl.exe issue jbeelandat_private (Thu Aug 30 2001 - 10:50:53 PDT)
  • RE: ntoskrnl.exe issue Curt Purdy (Thu Aug 30 2001 - 11:17:53 PDT)
• Strange entries in Apache access_log Bart Haezeleer (Thu Aug 30 2001 - 08:19:11 PDT)
  • Re: Strange entries in Apache access_log Ryan Russell (Thu Aug 30 2001 - 10:51:14 PDT)
  • Re: Strange entries in Apache access_log Jose Nazario (Thu Aug 30 2001 - 10:58:11 PDT)
• Resurgence of DNS scanning activity Keith.Morgan (Thu Aug 30 2001 - 06:47:47 PDT)
  • Re: Resurgence of DNS scanning activity John Kinsella (Thu Aug 30 2001 - 10:52:35 PDT)
• Win32.Invalid.A@mm Ryan Russell (Thu Aug 30 2001 - 11:34:08 PDT)
• Strange debug output (HTTP) Bjørn Augestad (Fri Aug 31 2001 - 11:09:16 PDT)
• Port 21816 attempts Rob Zietlow (Thu Aug 30 2001 - 20:38:08 PDT)

Last message date: Sat Sep 01 2001 - 11:12:48 PDT
Archived on: Sat Sep 01 2001 - 11:12:50 PDT

This archive was generated by hypermail 2b30 : Sat Sep 01 2001 - 11:12:50 PDT