Re: nimda subject line

From: Thomas Roessler (roessler@does-not-exist.org)
Date: Thu Sep 20 2001 - 01:44:07 PDT

  • Next message: Sven Carstens: "Loopback traffic on the net"

    On 2001-09-20 10:38:09 +0200, Thomas Roessler wrote:
    
    >The payload was the same one you see everywhere else, with the 
    >usual four-byte variation.
    
    I have to correct the latter part:  There is at least one more 
    variation in the worm code than the four-byte sequence I mentioned.
    
    -- 
    Thomas Roessler                        http://log.does-not-exist.org/
    
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Sep 20 2001 - 07:38:57 PDT