nimda tries to send mail after reboot

From: John Q. Public (tpublicat_private)
Date: Tue Sep 18 2001 - 11:41:21 PDT

  • Next message: Owen Creger: "New worm behavior ?"

    always to the same IP:  202.106.185.107
    
    sorry if it's been posted, but I haven't seen anything about that particular
    IP yet.
    
    the address appears unreachable (was hoping for an answer to identify itself)
    
    .nhoJ
    
    __
    
    from APNIC:
    
    inetnum:     202.106.0.0 - 202.106.255.255
    netname:     CHINANET-BJ
    descr:       CHINANET Beijing province network
    descr:       Data Communication Division
    descr:       China Telecom
    country:     CN
    admin-c:     CH93-AP
    tech-c:      SY21-AP
    mnt-by:      MAINT-CHINANET
    mnt-lower:   MAINT-CHINANET-BJ
    changed:     hostmasterat_private 20000101
    source:      APNIC
    
    person:      Chinanet Hostmaster
    address:     A12,Xin-Jie-Kou-Wai Street
    country:     CN
    phone:       +86-10-62370437
    fax-no:      +86-10-62053995
    e-mail:      hostmasterat_private
    nic-hdl:     CH93-AP
    mnt-by:      MAINT-CHINANET
    changed:     hostmasterat_private 20000101
    source:      APNIC
    
    person:      sun ying
    address:     Beijing Telecommunication Administration
    address:     TaiPingHu DongLi 18, Xicheng District
    address:     Beijing 100031
    country:     CN
    phone:       +86-10-66198941
    fax-no:      +86-10-68511003
    e-mail:      sunyat_private
    nic-hdl:     SY21-AP
    mnt-by:      MAINT-CHINANET-BJ
    changed:     sunyat_private 19980824
    source:      APNIC
    
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Sep 18 2001 - 12:25:38 PDT