Re: massive cmd.exe and root.exe attempts

From: screamer (screamerat_private)
Date: Tue Sep 18 2001 - 13:51:09 PDT

Next message: Brett Glass: "Re: nimda tries to send mail after reboot"

Previous message: Paul Gear: "Re: NIMDA has a built in timer? No hits lately"
In reply to: Sean Kelly: "Re: massive cmd.exe and root.exe attempts"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Sean Kelly wrote:

>On Tue, 18 Sep 2001, pbeamat_private wrote:
>
>>I am as well being hit by this worm.  Everything seems to be coming from
>>the same class A 64.*. 
>>
>
>	Not so here.  Nearly all my hits are coming from 217.something.
>
>--
>Sean Kelly
>

Almost all of the ones hitting here come from addresses with the same 
first octet in the IP address as my boxen have, possibly an intentional 
behaviour.

>
>
>
>
>----------------------------------------------------------------------------
>This list is provided by the SecurityFocus ARIS analyzer service.
>For more information on this free incident handling, management 
>and tracking system please see: http://aris.securityfocus.com
>




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Brett Glass: "Re: nimda tries to send mail after reboot"
Previous message: Paul Gear: "Re: NIMDA has a built in timer? No hits lately"
In reply to: Sean Kelly: "Re: massive cmd.exe and root.exe attempts"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Sep 18 2001 - 18:22:30 PDT