incidents 2001/10
By Date

Starting: Mon Oct 01 2001 - 10:09:25 PDT
Ending: Wed Oct 31 2001 - 21:37:48 PST

• Re: WARNING: Trojan Horse Disguised as Message from SecurityFocus and TrendMicro aleph1at_private (Mon Oct 01 2001 - 04:01:47 PDT)
• rpc.statd nikoat_private (Mon Oct 01 2001 - 09:09:48 PDT)
• Re: rpc.statd Jose Nazario (Mon Oct 01 2001 - 09:30:07 PDT)
• Scan of the Month - October Michael Clark (Mon Oct 01 2001 - 20:21:32 PDT)
• tcp/1176? Justin Shore (Tue Oct 02 2001 - 11:40:01 PDT)
• Re: tcp/1176? Josh Peck (Tue Oct 02 2001 - 14:01:07 PDT)
• Code Red gone to sleep? Jay D. Dyson (Tue Oct 02 2001 - 15:54:20 PDT)
• Re: Code Red gone to sleep? cambriaat_private (Tue Oct 02 2001 - 16:33:00 PDT)
• Re: Code Red gone to sleep? Ryan Russell (Tue Oct 02 2001 - 16:30:53 PDT)
• Re: Code Red gone to sleep? Kath (Tue Oct 02 2001 - 16:37:25 PDT)
• Re: Code Red gone to sleep? Andreas Östling (Wed Oct 03 2001 - 10:11:44 PDT)
• NEW FILES: Scan of the Month - October Michael Clark (Wed Oct 03 2001 - 13:34:20 PDT)
• User-agent Johan Denoyer (Wed Oct 03 2001 - 14:53:02 PDT)
• Re: User-agent Ryan Russell (Wed Oct 03 2001 - 15:17:03 PDT)
• RE: User-agent Dave Salovesh (Wed Oct 03 2001 - 15:23:42 PDT)
• Re: User-agent Chip McClure (Wed Oct 03 2001 - 15:28:22 PDT)
• SHELLCODE x86 NOOP Dan Terhesiu (Thu Oct 04 2001 - 02:32:31 PDT)
• Help: Weird email received & E-Safe Alert root (Thu Oct 04 2001 - 05:15:17 PDT)
• Automated scan-for-webserver-vulns tool ? Guy Poizat (Thu Oct 04 2001 - 06:06:57 PDT)
• RE: SHELLCODE x86 NOOP Steve Halligan (Thu Oct 04 2001 - 08:50:02 PDT)
• virus/worm threats VanMeter, John (Thu Oct 04 2001 - 03:31:16 PDT)
• RE: Automated scan-for-webserver-vulns tool ? Steve Halligan (Thu Oct 04 2001 - 09:04:19 PDT)
• Re: Help: Weird email received & E-Safe Alert Valdis.Kletnieksat_private (Thu Oct 04 2001 - 09:22:38 PDT)
• Re: SHELLCODE x86 NOOP Michal Nazarewicz (Thu Oct 04 2001 - 09:03:31 PDT)
• Re: Help: Weird email received & E-Safe Alert Bill_Roydsat_private (Thu Oct 04 2001 - 09:51:03 PDT)
• Re: virus/worm threats Stephen Friedl (Thu Oct 04 2001 - 09:51:22 PDT)
• RE: Help: Weird email received & E-Safe Alert Fernando Cardoso (Thu Oct 04 2001 - 11:01:39 PDT)
• RE: WARNING: Trojan Horse Disguised as Message from SecurityFocus and TrendMicro aleph1at_private (Thu Oct 04 2001 - 11:26:09 PDT)
• Re: SHELLCODE x86 NOOP Nick FitzGerald (Thu Oct 04 2001 - 14:28:36 PDT)
• Re: Code Red gone to sleep? hvdkooijat_private (Thu Oct 04 2001 - 16:29:45 PDT)
• Re: Code Red gone to sleep? cambriaat_private (Thu Oct 04 2001 - 20:51:39 PDT)
• Weird DNS scans Seth Milder (Thu Oct 04 2001 - 23:59:26 PDT)
• RE: virus/worm threats Harley David (Fri Oct 05 2001 - 02:06:40 PDT)
• Re: SHELLCODE x86 NOOP foobat_private (Fri Oct 05 2001 - 03:33:59 PDT)
• Re: Weird DNS scans Ryan Russell (Fri Oct 05 2001 - 09:30:56 PDT)
• Re: Weird DNS scans Richard Smith (Fri Oct 05 2001 - 09:13:49 PDT)
• new pop3 exploit out? leon (Fri Oct 05 2001 - 13:03:09 PDT)
• Re: Weird DNS scans John Hall (Fri Oct 05 2001 - 15:51:46 PDT)
• RE: new pop3 exploit out? leon (Fri Oct 05 2001 - 17:22:24 PDT)
• Re: new pop3 exploit out? Valdis.Kletnieksat_private (Fri Oct 05 2001 - 17:18:37 PDT)
• Re: Weird DNS scans Seth Milder (Fri Oct 05 2001 - 18:33:37 PDT)
• port 22->port 22 scans Pavel Kankovsky (Fri Oct 05 2001 - 17:08:49 PDT)
• Re: port 22->port 22 scans spaceork (Sat Oct 06 2001 - 12:43:44 PDT)
• IRIX "gr" core dumps Geoff Galitz (Sat Oct 06 2001 - 16:24:44 PDT)
• RE: new pop3 exploit out? Alvaro Soto (Sat Oct 06 2001 - 10:44:30 PDT)
• Re: port 22 scans + 53 scans Steven S (Sat Oct 06 2001 - 12:53:28 PDT)
• RE: port 22->port 22 scans Dean Cunningham (Sun Oct 07 2001 - 13:18:43 PDT)
• repeated zone transfer denied Ray (Sun Oct 07 2001 - 16:30:51 PDT)
• Re: IRIX "gr" core dumps Dino (Sun Oct 07 2001 - 17:04:34 PDT)
• Re: repeated zone transfer denied Ray (Sun Oct 07 2001 - 17:08:36 PDT)
• higher then normal anon FTP scanning Silent Bob (Mon Oct 08 2001 - 11:24:16 PDT)
• Re: port 22 scans + 53 scans John Sage (Mon Oct 08 2001 - 08:18:59 PDT)
• Re: Weird DNS scans John Hall (Mon Oct 08 2001 - 13:34:44 PDT)
• RE: new pop3 exploit out? James Weiler (Mon Oct 08 2001 - 12:31:06 PDT)
• Re: Weird DNS scans Seth Milder (Mon Oct 08 2001 - 15:55:10 PDT)
• Port 17889 - new attack? James Willmore (Mon Oct 08 2001 - 22:51:08 PDT)
• RE: new pop3 exploit out? Miller, Toby (Tue Oct 09 2001 - 08:02:25 PDT)
• Re: repeated zone transfer denied Dave Dittrich (Tue Oct 09 2001 - 00:37:06 PDT)
• Re: Port 17889 - new attack? Christian Sarmoria (Tue Oct 09 2001 - 09:07:05 PDT)
• Re: repeated zone transfer denied Dave Dittrich (Tue Oct 09 2001 - 11:54:19 PDT)
• Port 56035? Dietmar Braun (Wed Oct 10 2001 - 04:18:29 PDT)
• HTTP Probe by Webserver Alan Wright (Wed Oct 10 2001 - 15:31:16 PDT)
• RE: HTTP Probe by Webserver Andrew Blevins (Wed Oct 10 2001 - 15:41:45 PDT)
• Vacation Troller, Please Ignore Jensenne Roculan (Wed Oct 10 2001 - 15:38:47 PDT)
• RE: HTTP Probe by Webserver Dean Cunningham (Wed Oct 10 2001 - 18:28:21 PDT)
• RE: HTTP Probe by Webserver Vince Sola (Wed Oct 10 2001 - 16:52:45 PDT)
• Re: Port 17889 - new attack? James Willmore (Wed Oct 10 2001 - 22:37:27 PDT)
• really odd traffic Thomas Whipp (Thu Oct 11 2001 - 09:10:58 PDT)
• Re: Port 17889 - new attack? Arta (Thu Oct 11 2001 - 09:22:57 PDT)
• SSDP? john.smith@minolta-qms.com (Thu Oct 11 2001 - 12:50:06 PDT)
• Re: SSDP? dove (Thu Oct 11 2001 - 13:10:09 PDT)
• Re: SSDP? John Sage (Thu Oct 11 2001 - 13:55:59 PDT)
• fbi.gov weirdness? cg (Thu Oct 11 2001 - 15:41:01 PDT)
• RE: fbi.gov weirdness? Nicko Demeter (Thu Oct 11 2001 - 15:55:52 PDT)
• Re: fbi.gov weirdness? Chip McClure (Thu Oct 11 2001 - 16:03:07 PDT)
• Re: fbi.gov weirdness? Ryan Tucker (Thu Oct 11 2001 - 16:07:01 PDT)
• RE: fbi.gov weirdness? Rob Keown (Thu Oct 11 2001 - 16:12:34 PDT)
• RE: fbi.gov weirdness? Crosby, Herbert (OAO-HOU) (Fri Oct 12 2001 - 09:14:41 PDT)
• RE: fbi.gov weirdness? Michael B. Morell (Fri Oct 12 2001 - 09:40:09 PDT)
• Departure from the list - new moderators Alfred Huger (Fri Oct 12 2001 - 12:05:18 PDT)
• Re: fbi.gov weirdness? Allen Smith (Fri Oct 12 2001 - 12:48:55 PDT)
• Re: port 22->port 22 scans Pavel Kankovsky (Sat Oct 13 2001 - 14:12:03 PDT)
• Re: Who's liable? Jay D. Dyson (Sat Oct 13 2001 - 15:33:35 PDT)
• Re: Who's liable? - fbi Alvin Oga (Sat Oct 13 2001 - 15:59:52 PDT)
• Dead Thread - Who's Liable? Jensenne Roculan (Mon Oct 15 2001 - 09:15:46 PDT)
• "Worm" behavior -- port 80 honey pots Jon R. Kibler (Mon Oct 15 2001 - 11:43:29 PDT)
• Re: "Worm" behavior -- port 80 honey pots Rich Puhek (Mon Oct 15 2001 - 13:57:14 PDT)
• Re: "Worm" behavior -- port 80 honey pots Ryan Russell (Mon Oct 15 2001 - 14:08:39 PDT)
• original code red resurgence... Russell Fulton (Mon Oct 15 2001 - 16:39:05 PDT)
• RE: original code red resurgence... Fulton L. Preston Jr. (Tue Oct 16 2001 - 10:51:54 PDT)
• fragments of tcp streams containing http attacks Russell Fulton (Tue Oct 16 2001 - 17:05:30 PDT)
• New email worm DarkMachine Markus De Shon (Wed Oct 17 2001 - 07:40:16 PDT)
• portscan on tcp ports 1024 to 1280 Fletcher Mattox (Wed Oct 17 2001 - 10:05:39 PDT)
• [logs] Log Parsing Tools Tina Bird (Wed Oct 17 2001 - 07:27:02 PDT)
• Re: portscan on tcp ports 1024 to 1280 Joshua_Hillerat_private (Wed Oct 17 2001 - 10:15:20 PDT)
• RE: Scans from Moscow Alan Wright (Wed Oct 17 2001 - 10:28:24 PDT)
• More info on DarkMachine Markus De Shon (Wed Oct 17 2001 - 10:35:57 PDT)
• Re: portscan on tcp ports 1024 to 1280 dr john halewood (Wed Oct 17 2001 - 10:45:47 PDT)
• RE: Scans from Moscow Robert Woods (Wed Oct 17 2001 - 10:51:12 PDT)
• SV: More info on DarkMachine Peter Kruse (Wed Oct 17 2001 - 14:52:40 PDT)
• incident Silvex Security Team (Wed Oct 17 2001 - 15:11:03 PDT)
• Re: incident hvdkooijat_private (Wed Oct 17 2001 - 15:37:39 PDT)
• Re: SV: More info on DarkMachine Nick FitzGerald (Wed Oct 17 2001 - 17:38:42 PDT)
• fast ssh scans Can Erkin Acar (Thu Oct 18 2001 - 00:40:33 PDT)
• Re: fast ssh scans Daniel Martin (Thu Oct 18 2001 - 09:33:36 PDT)
• Re: many port 4599 probes Alan Wright (Thu Oct 18 2001 - 15:29:19 PDT)
• Re: many port 4599 probes Mike Tancsa (Thu Oct 18 2001 - 19:36:11 PDT)
• Has anyone seen this pattern? VanMeter, John (Fri Oct 19 2001 - 06:13:34 PDT)
• Trojan program Mike Peterson (Fri Oct 19 2001 - 06:01:47 PDT)
• Re: many port 4599 probes Ulrich Eckhardt (Fri Oct 19 2001 - 06:46:08 PDT)
• RE: Trojan program Kelley, John (Fri Oct 19 2001 - 08:41:26 PDT)
• Re: Has anyone seen this pattern? Jay D. Dyson (Fri Oct 19 2001 - 08:46:25 PDT)
• Re: Trojan program H C (Fri Oct 19 2001 - 10:36:29 PDT)
• Trojan Program Thread Mike Peterson (Fri Oct 19 2001 - 12:03:26 PDT)
• Strange tcpdump file Lindsay (Sat Oct 20 2001 - 13:05:56 PDT)
• Scans for SSHd via RIPE netblocks, anyone? Jay D. Dyson (Sun Oct 21 2001 - 01:06:27 PDT)
• suspicious http log Emre Yildirim (Sun Oct 21 2001 - 15:35:44 PDT)
• Re: suspicious http log bugtraq (Mon Oct 22 2001 - 04:45:34 PDT)
• Slow FTP scan Joe Smith (Mon Oct 22 2001 - 09:19:07 PDT)
• Re: Scans for SSHd via RIPE netblocks, anyone? daniel uriah clemens (Mon Oct 22 2001 - 09:42:02 PDT)
• Re: "Worm" behavior -- port 80 honey pots Alexander Bochmann (Mon Oct 22 2001 - 09:30:19 PDT)
• RE: Scans for SSHd via RIPE netblocks, anyone? Fernando Cardoso (Mon Oct 22 2001 - 09:50:21 PDT)
• RE: Scans for SSHd via RIPE netblocks, anyone? Sean Kelly (Mon Oct 22 2001 - 14:42:14 PDT)
• Re: Scans for SSHd via RIPE netblocks, anyone? Valdis.Kletnieksat_private (Mon Oct 22 2001 - 14:56:05 PDT)
• Unknown requests from IE 5 David Ward (Mon Oct 22 2001 - 15:20:58 PDT)
• Odd probes from Cisco equipment... Mike (Mon Oct 22 2001 - 15:30:48 PDT)
• Re: Strange tcpdump file vernat_private (Mon Oct 22 2001 - 20:47:19 PDT)
• RE: Unknown requests from IE 5 Tom Gallagher (Tue Oct 23 2001 - 02:39:10 PDT)
• Re: Odd probes from Cisco equipment... Richard.Smithat_private (Tue Oct 23 2001 - 06:39:01 PDT)
• /BurstingScript/WriteParametersPipe.asp Rob Keown (Tue Oct 23 2001 - 07:02:46 PDT)
• RE: What am I seeing? jkruser (Tue Oct 23 2001 - 08:38:36 PDT)
• Re: What am I seeing? Mike Lewinski (Tue Oct 23 2001 - 09:15:39 PDT)
• Re: /BurstingScript/WriteParametersPipe.asp Mordechai Ovits (Tue Oct 23 2001 - 09:16:20 PDT)
• Re: What am I seeing? Valdis.Kletnieksat_private (Tue Oct 23 2001 - 09:29:24 PDT)
• Re: What am I seeing? Richard.Smithat_private (Tue Oct 23 2001 - 10:35:22 PDT)
• securitynewsportal.com hacked Ivan@work (Tue Oct 23 2001 - 21:45:49 PDT)
• Re: securitynewsportal.com hacked Remco B. Brink (Wed Oct 24 2001 - 08:44:39 PDT)
• Odd traffic generated from Exchange Server Caruso, Anthony J. (Wed Oct 24 2001 - 09:53:09 PDT)
• RE: Odd traffic generated from Exchange Server Ryan Hill (Wed Oct 24 2001 - 10:57:19 PDT)
• RE: Odd traffic generated from Exchange Server Portnoy, Gary (Wed Oct 24 2001 - 12:18:23 PDT)
• Security Question Paul Speck (Wed Oct 24 2001 - 15:57:30 PDT)
• fwd: Re: Slow FTP scan vishal pranjale (Wed Oct 24 2001 - 23:34:35 PDT)
• NC_S_ISLCK Group Added Ed Shirley (Thu Oct 25 2001 - 07:21:33 PDT)
• RE: Security Question Hoyt Plunkett (Thu Oct 25 2001 - 07:43:22 PDT)
• Re: What am I seeing? 'Bill Scherr IV, GCIA' (Thu Oct 25 2001 - 08:24:35 PDT)
• winad.exe and winad-update.exe Mike Shaw (Thu Oct 25 2001 - 11:45:10 PDT)
• RE: winad.exe and winad-update.exe PNIXONat_private (Thu Oct 25 2001 - 12:24:23 PDT)
• RE: winad.exe and winad-update.exe Jensenne Roculan (Thu Oct 25 2001 - 13:30:18 PDT)
• code red request, but cant be resolved? Emre Yildirim (Thu Oct 25 2001 - 14:08:45 PDT)
• Re: fwd: Re: Slow FTP scan Joe Smith (Thu Oct 25 2001 - 14:22:45 PDT)
• Re: code red request, but cant be resolved? Mike Shaw (Thu Oct 25 2001 - 14:26:40 PDT)
• TCP FIN Increase Sam Brothers (Thu Oct 25 2001 - 14:26:36 PDT)
• Re: TCP FIN Increase Skip Carter (Thu Oct 25 2001 - 15:17:34 PDT)
• Xterm Yahoo - CQRMail (Thu Oct 25 2001 - 18:58:05 PDT)
• TCP/2484 Chris Arnold (Fri Oct 26 2001 - 08:09:53 PDT)
• Re: TCP/2484 Valdis.Kletnieksat_private (Fri Oct 26 2001 - 09:07:59 PDT)
• Strange Behaviour ! Naseer Bhatti (Fri Oct 26 2001 - 10:47:58 PDT)
• Re: Xterm dewt (Fri Oct 26 2001 - 11:09:00 PDT)
• Re: Strange Behaviour ! dewt (Fri Oct 26 2001 - 11:13:46 PDT)
• Re: Strange Behaviour ! Naseer Bhatti (Fri Oct 26 2001 - 11:29:29 PDT)
• Re: Strange Behaviour ! Christian Vogel (Fri Oct 26 2001 - 11:34:50 PDT)
• RE: Odd traffic generated from Exchange Server - Resolved Caruso, Anthony J. (Fri Oct 26 2001 - 14:57:59 PDT)
• Use of HEAD in web server scan Russell Fulton (Sun Oct 28 2001 - 13:52:42 PST)
• Re: Use of HEAD in web server scan Mike Lewinski (Sun Oct 28 2001 - 18:08:24 PST)
• Simultanious ping from lots of different hosts. Johannes Verelst (Mon Oct 29 2001 - 06:55:40 PST)
• rpc.statd buffer overflow attempt? John Brahy (Mon Oct 29 2001 - 07:45:21 PST)
• Re: rpc.statd buffer overflow attempt? Johannes Verelst (Mon Oct 29 2001 - 08:59:03 PST)
• Scan of the Month - October Michael Clark (Mon Oct 29 2001 - 16:54:58 PST)
• Re: Simultanious ping from lots of different hosts. Hubert BUT (Mon Oct 29 2001 - 22:53:14 PST)
• New Worm Variant? Aj Effin Reznor (Mon Oct 29 2001 - 23:19:32 PST)
• RE: New Worm Variant? Kester, Kelly (Tue Oct 30 2001 - 06:56:16 PST)
• New IIS exploit tool? Has anyone seen this pattern before? Thomas Haeberlen (Tue Oct 30 2001 - 03:47:00 PST)
• Re: New IIS exploit tool? Has anyone seen this pattern before? CT (Tue Oct 30 2001 - 08:51:52 PST)
• Re: New Worm Variant? Ryan Russell (Tue Oct 30 2001 - 09:08:42 PST)
• 33270:trinity connection form port 80 to local machine on port Bradley Filmer (Wed Oct 31 2001 - 00:11:43 PST)
• Re: 33270:trinity connection form port 80 to local machine on port Valdis.Kletnieksat_private (Wed Oct 31 2001 - 09:48:28 PST)
• Should I be concerned about? Jose Carlos Faial (Wed Oct 31 2001 - 11:05:45 PST)
• RE: Should I be concerned about? Mike Gilles (Wed Oct 31 2001 - 10:16:15 PST)
• Re: Should I be concerned about? Blake Frantz (Wed Oct 31 2001 - 10:31:41 PST)
• RE: Should I be concerned about? Antonio Vasconcelos (Wed Oct 31 2001 - 10:38:39 PST)
• RE: Should I be concerned about? Lance Spitzner (Wed Oct 31 2001 - 10:43:04 PST)
• Help with Nimda.E? Matt Beck (Wed Oct 31 2001 - 11:29:34 PST)
• RE: Nimda.E having an impact ?? Kinsey, Robert (Wed Oct 31 2001 - 14:53:01 PST)
• Re: Should I be concerned about? John Sage (Wed Oct 31 2001 - 19:21:32 PST)

Last message date: Wed Oct 31 2001 - 21:37:48 PST
Archived on: Wed Oct 31 2001 - 21:37:49 PST

This archive was generated by hypermail 2b30 : Wed Oct 31 2001 - 21:37:49 PST