UDP scans from CodeRed-infected hosts

From: Kyle Maus (sargonat_private)
Date: Tue Aug 07 2001 - 12:29:57 PDT

Next message: Ralph Mellor: "Re: more Code Red analysis"

Previous message: Bartel, Matt: "CR2 Incident - root.exe present, but explorer.exe process not?"
Next in thread: Tony Langdon: "RE: UDP scans from CodeRed-infected hosts"
Reply: Tony Langdon: "RE: UDP scans from CodeRed-infected hosts"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I am beginning to see UDP probes coming from servers which I had earlier 
identified as servers infected with CodeRed II.

Looks like things are about to become interesting.....


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Ralph Mellor: "Re: more Code Red analysis"
Previous message: Bartel, Matt: "CR2 Incident - root.exe present, but explorer.exe process not?"
Next in thread: Tony Langdon: "RE: UDP scans from CodeRed-infected hosts"
Reply: Tony Langdon: "RE: UDP scans from CodeRed-infected hosts"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Aug 07 2001 - 15:10:44 PDT