Re: NIMDA has a built in timer? No hits lately

From: Paul Gear (paulgearat_private)
Date: Tue Sep 18 2001 - 16:13:17 PDT

  • Next message: screamer: "Re: massive cmd.exe and root.exe attempts"

    David Kennedy CISSP wrote:
    > 
    > -----BEGIN PGP SIGNED MESSAGE-----
    > 
    > I started getting hit @ 13:09:55 UTC this morning.  My sensor have
    > not been touched since 19:15:10 UTC this afternoon.
    > 
    > Hypothesis:  It's exhausted the IP space that would touch my IP's or
    > it's turned itself off (if so will it turn itself on tomorrow ~1300
    > UTC?)
    
    Well, it's still going for it here in Australia at 23:00 UTC on
    2001-09-18.
    
    > Looking at the Internet Weather Report and the Internet Health
    > Report, the net-performance hit seems to be easing.
    
    No sign of performance improving here.  I visited the URL of the
    previously-noted defaced site in Iran around 10 minutes ago, and the
    77 Kb readme.eml that it wants to download is only 9% complete.  (I'm
    on 256 Kbps cable, but maybe it's more an indication that their links
    are flooded.)
    
    Paul
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Sep 18 2001 - 18:20:17 PDT