nimda subject line

From: Thomas Roessler (roessler@does-not-exist.org)
Date: Thu Sep 20 2001 - 01:38:09 PDT

  • Next message: Sandro Gauci: "[GFISEC] Nimda worm analysis"

    On incidents.org, they write that Nimda e-mail can easily be 
    recognized by the long, ugly, repetitive subject headers.
    
    This is not correct: Late on Sep 18, I received a Nimda-generated 
    message with the subject line "Thank you".  The payload was the same 
    one you see everywhere else, with the usual four-byte variation.
    
    -- 
    Thomas Roessler                        http://log.does-not-exist.org/
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Sep 20 2001 - 07:49:01 PDT