Ryan Russell wrote:
> I've caught 4 copies so far. All CRv2.
We have now analyzed a copy that we caught - it is also confirmed CRv2.
> We didn't reach saturation point last time, we hit the mode switch.
You are right. But looking at the growth curves, it was fairly close to
saturated by the time that happened.
This time the worm is not going to mode switch until the 20th. So it's going to
saturate and then all the infected hosts are going to sit and spray the Internet
with probes until they get fixed. Rebooting won't help much since it will only
be an hour or two until the host gets infected again.
Stuart.
--
Stuart Staniford --- President --- Silicon Defense
** Silicon Defense: Technical Support for Snort **
mailto:stuartat_private http://www.silicondefense.com/
(707) 445-4355 x 16 (707) 445-4222 (FAX)
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Aug 01 2001 - 11:07:28 PDT