incidents 2001/10
By Author

Starting: Mon Oct 01 2001 - 10:09:25 PDT
Ending: Wed Oct 31 2001 - 21:37:48 PST

• 'Bill Scherr IV, GCIA'
  • Re: What am I seeing? (Thu Oct 25 2001 - 08:24:35 PDT)
• Aj Effin Reznor
  • New Worm Variant? (Mon Oct 29 2001 - 23:19:32 PST)
• Alan Wright
  • Re: many port 4599 probes (Thu Oct 18 2001 - 15:29:19 PDT)
  • RE: Scans from Moscow (Wed Oct 17 2001 - 10:28:24 PDT)
  • HTTP Probe by Webserver (Wed Oct 10 2001 - 15:31:16 PDT)
• aleph1@securityfocus.com
  • RE: WARNING: Trojan Horse Disguised as Message from SecurityFocus and TrendMicro (Thu Oct 04 2001 - 11:26:09 PDT)
  • Re: WARNING: Trojan Horse Disguised as Message from SecurityFocus and TrendMicro (Mon Oct 01 2001 - 04:01:47 PDT)
• Alexander Bochmann
  • Re: "Worm" behavior -- port 80 honey pots (Mon Oct 22 2001 - 09:30:19 PDT)
• Alfred Huger
  • Departure from the list - new moderators (Fri Oct 12 2001 - 12:05:18 PDT)
• Allen Smith
  • Re: fbi.gov weirdness? (Fri Oct 12 2001 - 12:48:55 PDT)
• Alvaro Soto
  • RE: new pop3 exploit out? (Sat Oct 06 2001 - 10:44:30 PDT)
• Alvin Oga
  • Re: Who's liable? - fbi (Sat Oct 13 2001 - 15:59:52 PDT)
• Andreas Östling
  • Re: Code Red gone to sleep? (Wed Oct 03 2001 - 10:11:44 PDT)
• Andrew Blevins
  • RE: HTTP Probe by Webserver (Wed Oct 10 2001 - 15:41:45 PDT)
• Antonio Vasconcelos
  • RE: Should I be concerned about? (Wed Oct 31 2001 - 10:38:39 PST)
• Arta
  • Re: Port 17889 - new attack? (Thu Oct 11 2001 - 09:22:57 PDT)
• Bill_Royds@pch.gc.ca
  • Re: Help: Weird email received & E-Safe Alert (Thu Oct 04 2001 - 09:51:03 PDT)
• Blake Frantz
  • Re: Should I be concerned about? (Wed Oct 31 2001 - 10:31:41 PST)
• Bradley Filmer
  • 33270:trinity connection form port 80 to local machine on port (Wed Oct 31 2001 - 00:11:43 PST)
• bugtraq
  • Re: suspicious http log (Mon Oct 22 2001 - 04:45:34 PDT)
• cambria@owt.com
  • Re: Code Red gone to sleep? (Thu Oct 04 2001 - 20:51:39 PDT)
  • Re: Code Red gone to sleep? (Tue Oct 02 2001 - 16:33:00 PDT)
• Can Erkin Acar
  • fast ssh scans (Thu Oct 18 2001 - 00:40:33 PDT)
• Caruso, Anthony J.
  • RE: Odd traffic generated from Exchange Server - Resolved (Fri Oct 26 2001 - 14:57:59 PDT)
  • Odd traffic generated from Exchange Server (Wed Oct 24 2001 - 09:53:09 PDT)
• cg
  • fbi.gov weirdness? (Thu Oct 11 2001 - 15:41:01 PDT)
• Chip McClure
  • Re: fbi.gov weirdness? (Thu Oct 11 2001 - 16:03:07 PDT)
  • Re: User-agent (Wed Oct 03 2001 - 15:28:22 PDT)
• Chris Arnold
  • TCP/2484 (Fri Oct 26 2001 - 08:09:53 PDT)
• Christian Sarmoria
  • Re: Port 17889 - new attack? (Tue Oct 09 2001 - 09:07:05 PDT)
• Christian Vogel
  • Re: Strange Behaviour ! (Fri Oct 26 2001 - 11:34:50 PDT)
• Crosby, Herbert (OAO-HOU)
  • RE: fbi.gov weirdness? (Fri Oct 12 2001 - 09:14:41 PDT)
• CT
  • Re: New IIS exploit tool? Has anyone seen this pattern before? (Tue Oct 30 2001 - 08:51:52 PST)
• Dan Terhesiu
  • SHELLCODE x86 NOOP (Thu Oct 04 2001 - 02:32:31 PDT)
• Daniel Martin
  • Re: fast ssh scans (Thu Oct 18 2001 - 09:33:36 PDT)
• daniel uriah clemens
  • Re: Scans for SSHd via RIPE netblocks, anyone? (Mon Oct 22 2001 - 09:42:02 PDT)
• Dave Dittrich
  • Re: repeated zone transfer denied (Tue Oct 09 2001 - 11:54:19 PDT)
  • Re: repeated zone transfer denied (Tue Oct 09 2001 - 00:37:06 PDT)
• Dave Salovesh
  • RE: User-agent (Wed Oct 03 2001 - 15:23:42 PDT)
• David Ward
  • Unknown requests from IE 5 (Mon Oct 22 2001 - 15:20:58 PDT)
• Dean Cunningham
  • RE: HTTP Probe by Webserver (Wed Oct 10 2001 - 18:28:21 PDT)
  • RE: port 22->port 22 scans (Sun Oct 07 2001 - 13:18:43 PDT)
• dewt
  • Re: Strange Behaviour ! (Fri Oct 26 2001 - 11:13:46 PDT)
  • Re: Xterm (Fri Oct 26 2001 - 11:09:00 PDT)
• Dietmar Braun
  • Port 56035? (Wed Oct 10 2001 - 04:18:29 PDT)
• Dino
  • Re: IRIX "gr" core dumps (Sun Oct 07 2001 - 17:04:34 PDT)
• dove
  • Re: SSDP? (Thu Oct 11 2001 - 13:10:09 PDT)
• dr john halewood
  • Re: portscan on tcp ports 1024 to 1280 (Wed Oct 17 2001 - 10:45:47 PDT)
• Ed Shirley
  • NC_S_ISLCK Group Added (Thu Oct 25 2001 - 07:21:33 PDT)
• Emre Yildirim
  • code red request, but cant be resolved? (Thu Oct 25 2001 - 14:08:45 PDT)
  • suspicious http log (Sun Oct 21 2001 - 15:35:44 PDT)
• Fernando Cardoso
  • RE: Scans for SSHd via RIPE netblocks, anyone? (Mon Oct 22 2001 - 09:50:21 PDT)
  • RE: Help: Weird email received & E-Safe Alert (Thu Oct 04 2001 - 11:01:39 PDT)
• Fletcher Mattox
  • portscan on tcp ports 1024 to 1280 (Wed Oct 17 2001 - 10:05:39 PDT)
• foob@return0.net
  • Re: SHELLCODE x86 NOOP (Fri Oct 05 2001 - 03:33:59 PDT)
• Fulton L. Preston Jr.
  • RE: original code red resurgence... (Tue Oct 16 2001 - 10:51:54 PDT)
• Geoff Galitz
  • IRIX "gr" core dumps (Sat Oct 06 2001 - 16:24:44 PDT)
• Guy Poizat
  • Automated scan-for-webserver-vulns tool ? (Thu Oct 04 2001 - 06:06:57 PDT)
• H C
  • Re: Trojan program (Fri Oct 19 2001 - 10:36:29 PDT)
• Harley David
  • RE: virus/worm threats (Fri Oct 05 2001 - 02:06:40 PDT)
• Hoyt Plunkett
  • RE: Security Question (Thu Oct 25 2001 - 07:43:22 PDT)
• Hubert BUT
  • Re: Simultanious ping from lots of different hosts. (Mon Oct 29 2001 - 22:53:14 PST)
• hvdkooij@vanderkooij.org
  • Re: incident (Wed Oct 17 2001 - 15:37:39 PDT)
  • Re: Code Red gone to sleep? (Thu Oct 04 2001 - 16:29:45 PDT)
• Ivan@work
  • securitynewsportal.com hacked (Tue Oct 23 2001 - 21:45:49 PDT)
• James Weiler
  • RE: new pop3 exploit out? (Mon Oct 08 2001 - 12:31:06 PDT)
• James Willmore
  • Re: Port 17889 - new attack? (Wed Oct 10 2001 - 22:37:27 PDT)
  • Port 17889 - new attack? (Mon Oct 08 2001 - 22:51:08 PDT)
• Jay D. Dyson
  • Scans for SSHd via RIPE netblocks, anyone? (Sun Oct 21 2001 - 01:06:27 PDT)
  • Re: Has anyone seen this pattern? (Fri Oct 19 2001 - 08:46:25 PDT)
  • Re: Who's liable? (Sat Oct 13 2001 - 15:33:35 PDT)
  • Code Red gone to sleep? (Tue Oct 02 2001 - 15:54:20 PDT)
• Jensenne Roculan
  • RE: winad.exe and winad-update.exe (Thu Oct 25 2001 - 13:30:18 PDT)
  • Dead Thread - Who's Liable? (Mon Oct 15 2001 - 09:15:46 PDT)
  • Vacation Troller, Please Ignore (Wed Oct 10 2001 - 15:38:47 PDT)
• jkruser
  • RE: What am I seeing? (Tue Oct 23 2001 - 08:38:36 PDT)
• Joe Smith
  • Re: fwd: Re: Slow FTP scan (Thu Oct 25 2001 - 14:22:45 PDT)
  • Slow FTP scan (Mon Oct 22 2001 - 09:19:07 PDT)
• Johan Denoyer
  • User-agent (Wed Oct 03 2001 - 14:53:02 PDT)
• Johannes Verelst
  • Re: rpc.statd buffer overflow attempt? (Mon Oct 29 2001 - 08:59:03 PST)
  • Simultanious ping from lots of different hosts. (Mon Oct 29 2001 - 06:55:40 PST)
• John Brahy
  • rpc.statd buffer overflow attempt? (Mon Oct 29 2001 - 07:45:21 PST)
• John Hall
  • Re: Weird DNS scans (Mon Oct 08 2001 - 13:34:44 PDT)
  • Re: Weird DNS scans (Fri Oct 05 2001 - 15:51:46 PDT)
• John Sage
  • Re: Should I be concerned about? (Wed Oct 31 2001 - 19:21:32 PST)
  • Re: SSDP? (Thu Oct 11 2001 - 13:55:59 PDT)
  • Re: port 22 scans + 53 scans (Mon Oct 08 2001 - 08:18:59 PDT)
• john.smith@minolta-qms.com
  • SSDP? (Thu Oct 11 2001 - 12:50:06 PDT)
• Jon R. Kibler
  • "Worm" behavior -- port 80 honey pots (Mon Oct 15 2001 - 11:43:29 PDT)
• Jose Carlos Faial
  • Should I be concerned about? (Wed Oct 31 2001 - 11:05:45 PST)
• Jose Nazario
  • Re: rpc.statd (Mon Oct 01 2001 - 09:30:07 PDT)
• Josh Peck
  • Re: tcp/1176? (Tue Oct 02 2001 - 14:01:07 PDT)
• Joshua_Hiller@aeanet.org
  • Re: portscan on tcp ports 1024 to 1280 (Wed Oct 17 2001 - 10:15:20 PDT)
• Justin Shore
  • tcp/1176? (Tue Oct 02 2001 - 11:40:01 PDT)
• Kath
  • Re: Code Red gone to sleep? (Tue Oct 02 2001 - 16:37:25 PDT)
• Kelley, John
  • RE: Trojan program (Fri Oct 19 2001 - 08:41:26 PDT)
• Kester, Kelly
  • RE: New Worm Variant? (Tue Oct 30 2001 - 06:56:16 PST)
• Kinsey, Robert
  • RE: Nimda.E having an impact ?? (Wed Oct 31 2001 - 14:53:01 PST)
• Lance Spitzner
  • RE: Should I be concerned about? (Wed Oct 31 2001 - 10:43:04 PST)
• leon
  • RE: new pop3 exploit out? (Fri Oct 05 2001 - 17:22:24 PDT)
  • new pop3 exploit out? (Fri Oct 05 2001 - 13:03:09 PDT)
• Lindsay
  • Strange tcpdump file (Sat Oct 20 2001 - 13:05:56 PDT)
• Markus De Shon
  • More info on DarkMachine (Wed Oct 17 2001 - 10:35:57 PDT)
  • New email worm DarkMachine (Wed Oct 17 2001 - 07:40:16 PDT)
• Matt Beck
  • Help with Nimda.E? (Wed Oct 31 2001 - 11:29:34 PST)
• Michael B. Morell
  • RE: fbi.gov weirdness? (Fri Oct 12 2001 - 09:40:09 PDT)
• Michael Clark
  • Scan of the Month - October (Mon Oct 29 2001 - 16:54:58 PST)
  • NEW FILES: Scan of the Month - October (Wed Oct 03 2001 - 13:34:20 PDT)
  • Scan of the Month - October (Mon Oct 01 2001 - 20:21:32 PDT)
• Michal Nazarewicz
  • Re: SHELLCODE x86 NOOP (Thu Oct 04 2001 - 09:03:31 PDT)
• Mike
  • Odd probes from Cisco equipment... (Mon Oct 22 2001 - 15:30:48 PDT)
• Mike Gilles
  • RE: Should I be concerned about? (Wed Oct 31 2001 - 10:16:15 PST)
• Mike Lewinski
  • Re: Use of HEAD in web server scan (Sun Oct 28 2001 - 18:08:24 PST)
  • Re: What am I seeing? (Tue Oct 23 2001 - 09:15:39 PDT)
• Mike Peterson
  • Trojan Program Thread (Fri Oct 19 2001 - 12:03:26 PDT)
  • Trojan program (Fri Oct 19 2001 - 06:01:47 PDT)
• Mike Shaw
  • Re: code red request, but cant be resolved? (Thu Oct 25 2001 - 14:26:40 PDT)
  • winad.exe and winad-update.exe (Thu Oct 25 2001 - 11:45:10 PDT)
• Mike Tancsa
  • Re: many port 4599 probes (Thu Oct 18 2001 - 19:36:11 PDT)
• Miller, Toby
  • RE: new pop3 exploit out? (Tue Oct 09 2001 - 08:02:25 PDT)
• Mordechai Ovits
  • Re: /BurstingScript/WriteParametersPipe.asp (Tue Oct 23 2001 - 09:16:20 PDT)
• Naseer Bhatti
  • Re: Strange Behaviour ! (Fri Oct 26 2001 - 11:29:29 PDT)
  • Strange Behaviour ! (Fri Oct 26 2001 - 10:47:58 PDT)
• Nick FitzGerald
  • Re: SV: More info on DarkMachine (Wed Oct 17 2001 - 17:38:42 PDT)
  • Re: SHELLCODE x86 NOOP (Thu Oct 04 2001 - 14:28:36 PDT)
• Nicko Demeter
  • RE: fbi.gov weirdness? (Thu Oct 11 2001 - 15:55:52 PDT)
• niko@digitalenigma.com
  • rpc.statd (Mon Oct 01 2001 - 09:09:48 PDT)
• Paul Speck
  • Security Question (Wed Oct 24 2001 - 15:57:30 PDT)
• Pavel Kankovsky
  • Re: port 22->port 22 scans (Sat Oct 13 2001 - 14:12:03 PDT)
  • port 22->port 22 scans (Fri Oct 05 2001 - 17:08:49 PDT)
• Peter Kruse
  • SV: More info on DarkMachine (Wed Oct 17 2001 - 14:52:40 PDT)
• PNIXON@ci.somerville.ma.us
  • RE: winad.exe and winad-update.exe (Thu Oct 25 2001 - 12:24:23 PDT)
• Portnoy, Gary
  • RE: Odd traffic generated from Exchange Server (Wed Oct 24 2001 - 12:18:23 PDT)
• Ray
  • Re: repeated zone transfer denied (Sun Oct 07 2001 - 17:08:36 PDT)
  • repeated zone transfer denied (Sun Oct 07 2001 - 16:30:51 PDT)
• Remco B. Brink
  • Re: securitynewsportal.com hacked (Wed Oct 24 2001 - 08:44:39 PDT)
• Rich Puhek
  • Re: "Worm" behavior -- port 80 honey pots (Mon Oct 15 2001 - 13:57:14 PDT)
• Richard Smith
  • Re: Weird DNS scans (Fri Oct 05 2001 - 09:13:49 PDT)
• Richard.Smith@predictive.com
  • Re: What am I seeing? (Tue Oct 23 2001 - 10:35:22 PDT)
  • Re: Odd probes from Cisco equipment... (Tue Oct 23 2001 - 06:39:01 PDT)
• Rob Keown
  • /BurstingScript/WriteParametersPipe.asp (Tue Oct 23 2001 - 07:02:46 PDT)
  • RE: fbi.gov weirdness? (Thu Oct 11 2001 - 16:12:34 PDT)
• Robert Woods
  • RE: Scans from Moscow (Wed Oct 17 2001 - 10:51:12 PDT)
• root
  • Help: Weird email received & E-Safe Alert (Thu Oct 04 2001 - 05:15:17 PDT)
• Russell Fulton
  • Use of HEAD in web server scan (Sun Oct 28 2001 - 13:52:42 PST)
  • fragments of tcp streams containing http attacks (Tue Oct 16 2001 - 17:05:30 PDT)
  • original code red resurgence... (Mon Oct 15 2001 - 16:39:05 PDT)
• Ryan Hill
  • RE: Odd traffic generated from Exchange Server (Wed Oct 24 2001 - 10:57:19 PDT)
• Ryan Russell
  • Re: New Worm Variant? (Tue Oct 30 2001 - 09:08:42 PST)
  • Re: "Worm" behavior -- port 80 honey pots (Mon Oct 15 2001 - 14:08:39 PDT)
  • Re: Weird DNS scans (Fri Oct 05 2001 - 09:30:56 PDT)
  • Re: User-agent (Wed Oct 03 2001 - 15:17:03 PDT)
  • Re: Code Red gone to sleep? (Tue Oct 02 2001 - 16:30:53 PDT)
• Ryan Tucker
  • Re: fbi.gov weirdness? (Thu Oct 11 2001 - 16:07:01 PDT)
• Sam Brothers
  • TCP FIN Increase (Thu Oct 25 2001 - 14:26:36 PDT)
• Sean Kelly
  • RE: Scans for SSHd via RIPE netblocks, anyone? (Mon Oct 22 2001 - 14:42:14 PDT)
• Seth Milder
  • Re: Weird DNS scans (Mon Oct 08 2001 - 15:55:10 PDT)
  • Re: Weird DNS scans (Fri Oct 05 2001 - 18:33:37 PDT)
  • Weird DNS scans (Thu Oct 04 2001 - 23:59:26 PDT)
• Silent Bob
  • higher then normal anon FTP scanning (Mon Oct 08 2001 - 11:24:16 PDT)
• Silvex Security Team
  • incident (Wed Oct 17 2001 - 15:11:03 PDT)
• Skip Carter
  • Re: TCP FIN Increase (Thu Oct 25 2001 - 15:17:34 PDT)
• spaceork
  • Re: port 22->port 22 scans (Sat Oct 06 2001 - 12:43:44 PDT)
• Stephen Friedl
  • Re: virus/worm threats (Thu Oct 04 2001 - 09:51:22 PDT)
• Steve Halligan
  • RE: Automated scan-for-webserver-vulns tool ? (Thu Oct 04 2001 - 09:04:19 PDT)
  • RE: SHELLCODE x86 NOOP (Thu Oct 04 2001 - 08:50:02 PDT)
• Steven S
  • Re: port 22 scans + 53 scans (Sat Oct 06 2001 - 12:53:28 PDT)
• Thomas Haeberlen
  • New IIS exploit tool? Has anyone seen this pattern before? (Tue Oct 30 2001 - 03:47:00 PST)
• Thomas Whipp
  • really odd traffic (Thu Oct 11 2001 - 09:10:58 PDT)
• Tina Bird
  • [logs] Log Parsing Tools (Wed Oct 17 2001 - 07:27:02 PDT)
• Tom Gallagher
  • RE: Unknown requests from IE 5 (Tue Oct 23 2001 - 02:39:10 PDT)
• Ulrich Eckhardt
  • Re: many port 4599 probes (Fri Oct 19 2001 - 06:46:08 PDT)
• Valdis.Kletnieks@vt.edu
  • Re: 33270:trinity connection form port 80 to local machine on port (Wed Oct 31 2001 - 09:48:28 PST)
  • Re: TCP/2484 (Fri Oct 26 2001 - 09:07:59 PDT)
  • Re: What am I seeing? (Tue Oct 23 2001 - 09:29:24 PDT)
  • Re: Scans for SSHd via RIPE netblocks, anyone? (Mon Oct 22 2001 - 14:56:05 PDT)
  • Re: new pop3 exploit out? (Fri Oct 05 2001 - 17:18:37 PDT)
  • Re: Help: Weird email received & E-Safe Alert (Thu Oct 04 2001 - 09:22:38 PDT)
• VanMeter, John
  • Has anyone seen this pattern? (Fri Oct 19 2001 - 06:13:34 PDT)
  • virus/worm threats (Thu Oct 04 2001 - 03:31:16 PDT)
• vern@ee.lbl.gov
  • Re: Strange tcpdump file (Mon Oct 22 2001 - 20:47:19 PDT)
• Vince Sola
  • RE: HTTP Probe by Webserver (Wed Oct 10 2001 - 16:52:45 PDT)
• vishal pranjale
  • fwd: Re: Slow FTP scan (Wed Oct 24 2001 - 23:34:35 PDT)
• Yahoo - CQRMail
  • Xterm (Thu Oct 25 2001 - 18:58:05 PDT)

Last message date: Wed Oct 31 2001 - 21:37:48 PST
Archived on: Wed Oct 31 2001 - 21:37:49 PST

This archive was generated by hypermail 2b30 : Wed Oct 31 2001 - 21:37:49 PST