incidents 2001/11
By Author

Starting: Wed Oct 31 2001 - 12:33:12 PST
Ending: Sat Dec 01 2001 - 13:50:30 PST

• Aaron
  • Re: Questions (Wed Nov 21 2001 - 10:18:25 PST)
• Adcock, Matt
  • RE: Windows XP - Still has a Windows NT4 DoS hangover? (Wed Nov 28 2001 - 08:58:46 PST)
• Aron_Croftat_private
  • Re: New Worm similar to BadTrans.B? [Virus Checked] (Wed Nov 28 2001 - 10:35:31 PST)
• Arthur Donkers
  • Re: Need Urgent Info about SQL Worm (Fri Nov 23 2001 - 08:38:23 PST)
  • Re: MS-SQL Worm? (Tue Nov 20 2001 - 08:40:02 PST)
  • Re: MS-SQL Worm? (Tue Nov 20 2001 - 10:50:10 PST)
  • Re: MS-SQL Worm? (Tue Nov 20 2001 - 08:47:16 PST)
• Ascent - Compton, Richard
  • RE: Proxy Scans to dial up hosts... (Fri Nov 30 2001 - 14:34:47 PST)
• Barber, Chris
  • RE: Firewall hits/unknown ports (Mon Nov 05 2001 - 05:04:55 PST)
• Becky Bace
  • RE: Network and Incident Symbology: Comments Wanted (Fri Nov 09 2001 - 12:14:35 PST)
• Bill_Roydsat_private
  • Re: Proxy Scans to dial up hosts... (Fri Nov 30 2001 - 14:03:49 PST)
• Blake McNeill
  • Re: Malicious use of grc.com (Mon Nov 26 2001 - 23:46:09 PST)
• Bob Fryer
  • Windows XP - Still has a Windows NT4 DoS hangover? (Tue Nov 27 2001 - 21:26:24 PST)
• bonkat_private
  • Firewall hits/unknown ports (Sun Nov 04 2001 - 07:06:04 PST)
• Boyan Krosnov
  • RE: Strange kernel happenings (Thu Nov 01 2001 - 11:28:51 PST)
• Brett Glass
  • Re: W32.Badtrans.B@mm (Mon Nov 26 2001 - 14:13:15 PST)
• Brice Carlson
  • SUB7 (update) Now Netbus too! (Tue Nov 13 2001 - 20:23:15 PST)
  • Re: sub-7 (Mon Nov 12 2001 - 18:42:59 PST)
• cambriaat_private
  • Re: Posting to Incidents list, was: Re: Help with Nimda.E? (Thu Nov 01 2001 - 13:28:55 PST)
• Chip McClure
  • Re: Code Red -- AGAIN?!? (Thu Nov 29 2001 - 16:43:10 PST)
• Chris Brenton
  • Re: Should I be concerned about? (long reply, grab a sandwich) (Thu Nov 01 2001 - 06:05:46 PST)
• Dan Ellis
  • Re: Posting to Incidents list, was: Re: Help with Nimda.E? (Thu Nov 01 2001 - 10:17:01 PST)
• Dave Dittrich
  • Re: Analysis of SSH crc32 compensation attack detector exploit (Wed Nov 14 2001 - 10:21:49 PST)
  • Re: Analysis of SSH crc32 compensation attack detector exploit (Wed Nov 14 2001 - 10:21:49 PST)
  • Re: Analysis of SSH crc32 compensation attack detector exploit (Fri Nov 09 2001 - 13:03:34 PST)
  • Analysis of SSH crc32 compensation attack detector exploit (Thu Nov 08 2001 - 23:32:32 PST)
  • Analysis of SSH crc32 compensation attack detector exploit (Thu Nov 08 2001 - 23:32:32 PST)
  • Re: Two-Headed Worm - ChinaWorm (analysis) (Mon Nov 05 2001 - 10:42:29 PST)
• Dave Mitchell
  • Re: Proxy Scans to dail up hosts... (Fri Nov 30 2001 - 14:12:01 PST)
• Davis, Scott
  • RE: SUB7 (update) Now Netbus too! (Wed Nov 14 2001 - 09:27:02 PST)
  • RE: SUB7 (update) Now Netbus too! (Wed Nov 14 2001 - 08:36:53 PST)
• Devdas Bhagat
  • Re: Questions = Thanks (Wed Nov 21 2001 - 22:17:06 PST)
• Dial Joe
  • RE: Nimda Infections (Mon Nov 12 2001 - 16:46:13 PST)
• Douglas P. Brown
  • MS-SQL Worm? (Tue Nov 20 2001 - 06:54:18 PST)
• Drew E. Gilkey
  • Corrupted Directories, Intrusions, and Nimda Oh MY (Thu Nov 08 2001 - 17:48:30 PST)
• dschultzat_private
  • RE: port 6635 and port 9705 (Thu Nov 15 2001 - 00:52:31 PST)
• Dug Song
  • A Snapshot of Global Internet Worm Activity (Tue Nov 13 2001 - 12:34:22 PST)
• Duncan Simpson
  • Re: Strange SMTP Garbage Flood (Wed Nov 14 2001 - 08:49:35 PST)
• Emre Yildirim
  • Re: Code Red -- AGAIN?!? (Thu Nov 29 2001 - 21:10:36 PST)
• Eric Hall
  • Re: Code Red -- AGAIN?!? (Fri Nov 30 2001 - 13:34:46 PST)
• Ezequiel Diaz-Pacheco
  • Re: IIS (Possible DoS floating around) (Mon Nov 12 2001 - 13:58:55 PST)
• Fernando Cardoso
  • RE: Possible Trojan/Virus: while.com. (Mon Nov 26 2001 - 08:45:51 PST)
  • RE: SUB7 (update) Now Netbus too! (Wed Nov 14 2001 - 09:07:37 PST)
• Fredrik Ostergren
  • Re: any1 stumbled across eCkit ? (Thu Nov 29 2001 - 01:55:44 PST)
• freeholdat_private
  • Re: Firewall hits/unknown ports (Mon Nov 05 2001 - 07:59:54 PST)
• gabriel rosenkoetter
  • Re: Malicious use of grc.com (Tue Nov 27 2001 - 20:32:10 PST)
  • Re: More ssh attempts (Thu Nov 22 2001 - 11:30:56 PST)
• gattaca
  • Re: SUB7 (update) Now Netbus too! (Wed Nov 14 2001 - 09:12:44 PST)
• Geoff Poer
  • Strange TCP Sweep to 0.0.0.0 (Fri Nov 09 2001 - 09:34:30 PST)
• Geoffrey King
  • Strange Web requests. (Fri Nov 30 2001 - 08:01:12 PST)
• Glenn Forbes Fleming Larratt
  • Re: Firewall hits/unknown ports (Sun Nov 04 2001 - 19:28:29 PST)
  • Re: Strange connections to ports 1214, 6346 and 28800 (Fri Nov 02 2001 - 08:47:45 PST)
• Grimes, Shawn (NIA/IRP)
  • Proxy Scans to dail up hosts... (Fri Nov 30 2001 - 07:14:27 PST)
  • RE: Code Red -- AGAIN?!? (Fri Nov 30 2001 - 05:15:59 PST)
• H C
  • Re: Need Incident Handling Process Framework (Fri Nov 09 2001 - 11:48:44 PST)
  • Re: Corrupted Directories, Intrusions, and Nimda Oh MY (Fri Nov 09 2001 - 03:54:31 PST)
  • Posting to Incidents list, was: Re: Help with Nimda.E? (Thu Nov 01 2001 - 09:18:36 PST)
• Holger van Lengerich
  • Re: Two-Headed Worm - ChinaWorm (analysis) (Mon Nov 05 2001 - 07:59:51 PST)
• Homer Wilson Smith
  • Re: More ssh attempts (Thu Nov 22 2001 - 16:46:20 PST)
• Howard Gleason
  • possible new Nimda variant (Fri Nov 16 2001 - 05:53:01 PST)
• hush.little.babyat_private
  • [ALERT] Remote File Execution By Web or Mail: Internet Explorer (Wed Nov 21 2001 - 11:12:00 PST)
• hvdkooijat_private
  • Re: Bogus Email (Sun Nov 04 2001 - 22:50:13 PST)
• Ian Jones
  • Re: any1 stumbled across eCkit ? (Mon Nov 26 2001 - 15:35:36 PST)
• Ihsahn Diablo
  • RE: Questions = Thanks (Wed Nov 21 2001 - 13:19:44 PST)
  • Questions (Wed Nov 21 2001 - 04:54:02 PST)
• incidents-return-2127-jwa=jammed.comat_private
  • Re: MS-SQL Worm? (Tue Nov 20 2001 - 12:27:39 PST)
• J Jewitt
  • Need Incident Handling Process Framework (Fri Nov 09 2001 - 08:48:47 PST)
• j.e.r.k. ROCKS
  • solaris nscd cores (Fri Nov 30 2001 - 05:43:59 PST)
• jabba
  • Re: MS-SQL Worm? (Tue Nov 20 2001 - 09:24:30 PST)
• jared mc
  • Re: Strange TCP Sweep to 0.0.0.0 (Tue Nov 13 2001 - 08:04:37 PST)
• Jason Robertson
  • RE: Strange "port scans" from a spoofed IP (Sun Nov 11 2001 - 15:55:33 PST)
• Jay D. Dyson
  • Re: Code Red -- AGAIN?!? (Thu Nov 29 2001 - 16:15:15 PST)
  • Re: Possible Trojan/Virus: while.com. (Mon Nov 26 2001 - 10:07:31 PST)
  • Possible Trojan/Virus: while.com. (Sun Nov 25 2001 - 22:21:58 PST)
• Jeff Anderson-Lee
  • Re: [unisog] MS-SQL Worm? (Wed Nov 21 2001 - 13:25:20 PST)
• Jeroen Peters
  • Strange connections to ports 1214, 6346 and 28800 (Fri Nov 02 2001 - 02:10:16 PST)
• Jim Harrison (SPG)
  • RE: Nimda Infections (Mon Nov 12 2001 - 16:52:29 PST)
• Jim Howard
  • port 6635 and port 9705 (Wed Nov 14 2001 - 09:29:08 PST)
  • RE: Nimda Infections (Tue Nov 13 2001 - 06:31:41 PST)
• Joerg Over
  • Re: SYN Flood attack with sequential destination ports? (Thu Nov 08 2001 - 11:08:50 PST)
• Johannes Verelst
  • Re: new trojan? (Wed Nov 21 2001 - 10:01:23 PST)
  • Re: MS-SQL Worm? (Tue Nov 20 2001 - 11:11:20 PST)
  • Re: Strange SMTP Garbage Flood (Wed Nov 14 2001 - 13:11:08 PST)
• John Sage
  • Re: Strange Traffic.. (Thu Nov 29 2001 - 21:26:50 PST)
  • Re: W32.Badtrans.B@mm (Mon Nov 26 2001 - 14:46:52 PST)
  • Re: Possible Trojan/Virus: while.com. (Mon Nov 26 2001 - 09:46:27 PST)
  • Re: sub-7 (Tue Nov 13 2001 - 08:41:58 PST)
• john.huckat_private
  • strange log (Fri Nov 16 2001 - 12:09:01 PST)
• Jon R. Kibler
  • Strange "port scans" from a spoofed IP (Mon Nov 05 2001 - 15:37:04 PST)
• Jose Carlos Faial
  • Re: Should I be concerned about? (Thu Nov 01 2001 - 09:05:12 PST)
• Jose Nazario
  • Re: SSH CRC32? What am I seeing? (Wed Nov 21 2001 - 09:19:59 PST)
  • Re: Possible DDos Network Creation with ssh crc exploit (Tue Nov 13 2001 - 16:14:55 PST)
• Josh Lutz
  • Fragmentation Concerns... (Tue Nov 20 2001 - 10:18:26 PST)
• joshbat_private
  • Re: Possible Trojan/Virus: while.com. (Mon Nov 26 2001 - 09:23:34 PST)
• Joshua Wright
  • RE: SYN Flood attack with sequential destination ports? (Fri Nov 09 2001 - 12:28:15 PST)
• Kaneda Akira
  • Re: Forwarded mail.... (Thu Nov 22 2001 - 13:05:13 PST)
• Keith.Morgan
  • RE: IIS (Possible DoS floating around) (Mon Nov 12 2001 - 11:12:39 PST)
  • RE: IIS (Possible DoS floating around) (Mon Nov 12 2001 - 10:18:27 PST)
  • IIS (Possible DoS floating around) (Mon Nov 12 2001 - 09:27:13 PST)
  • RE: Strange IIS behavior, (Mon Nov 12 2001 - 08:12:37 PST)
  • RE: Strange "port scans" from a spoofed IP (Fri Nov 09 2001 - 07:58:10 PST)
• Lance Spitzner
  • Announcement: New Maillist - Honeypots (Mon Nov 19 2001 - 08:52:23 PST)
• Leon de France
  • sub-7 (Mon Nov 12 2001 - 11:28:15 PST)
• Lew E. Lefton
  • Re: Corrupted Directories, Intrusions, and Nimda Oh MY (Thu Nov 08 2001 - 20:38:30 PST)
• Liudvikas Bukys
  • W32.Badtrans.B@mm (Mon Nov 26 2001 - 13:30:54 PST)
• Loki
  • RE: Firewall hits/unknown ports (Sun Nov 04 2001 - 20:00:01 PST)
• macdaddyat_private
  • Re: Strange SMTP Garbage Flood (Tue Nov 13 2001 - 18:20:53 PST)
• Magniat_private
  • Malicious use of grc.com (Mon Nov 26 2001 - 11:53:52 PST)
• Marc Fossi
  • Re: W32.Badtrans.B@mm (Mon Nov 26 2001 - 13:46:48 PST)
• Marco Slaviero
  • Re: More ssh attempts (Fri Nov 23 2001 - 01:17:53 PST)
  • More ssh attempts (Thu Nov 22 2001 - 01:24:43 PST)
• Markus Kern
  • Re: [ALERT] Remote File Execution By Web or Mail: Internet Explorer (Fri Nov 23 2001 - 08:18:41 PST)
• Markus Stumpf
  • Re: Re[2]: Strange Traffic.. (Fri Nov 30 2001 - 14:53:04 PST)
• Martin Roesch
  • Re: SSH CRC32? What am I seeing? (Wed Nov 21 2001 - 13:03:52 PST)
• Matt Beck
  • FW: Help with Nimda.E? (Thu Nov 01 2001 - 08:56:29 PST)
• Matthias Merkel
  • Need Urgent Info about SQL Worm (Thu Nov 22 2001 - 18:24:11 PST)
• McCammon, Keith
  • RE: Problems with modem hanging up after an intrusion (Thu Nov 08 2001 - 12:39:15 PST)
• Michael B. Morell
  • RE: E-mail with ties to possible malicious website -MORE (Thu Nov 08 2001 - 11:54:31 PST)
  • E-mail with ties to possible malicious website (Tue Nov 06 2001 - 09:15:15 PST)
• Mike Grantham
  • Possible DDos Network Creation with ssh crc exploit (Tue Nov 13 2001 - 15:28:17 PST)
• Mike Lewinski
  • Re: Questions (Wed Nov 21 2001 - 10:39:58 PST)
  • Re: Corrupted Directories, Intrusions, and Nimda Oh MY (Thu Nov 08 2001 - 21:29:54 PST)
• Mike Shaw
  • Re: IIS (Possible DoS floating around) (Mon Nov 12 2001 - 10:03:06 PST)
  • Re: Corrupted Directories, Intrusions, and Nimda Oh MY (Fri Nov 09 2001 - 07:13:29 PST)
• Mike Tibor
  • Strange SMTP Garbage Flood (Tue Nov 13 2001 - 17:52:28 PST)
• mstevensonat_private
  • Strange kernel happenings (Thu Nov 01 2001 - 09:12:20 PST)
• Nathan Einwechter
  • Re: sub-7 (Mon Nov 12 2001 - 19:36:52 PST)
  • Re: multiple attempts to login via telnet from multiple IP's ... new worm? (Thu Nov 08 2001 - 18:12:21 PST)
• Neil Dickey
  • RE: Nimda Infections (Tue Nov 13 2001 - 09:03:12 PST)
  • Re: sub-7 (Mon Nov 12 2001 - 14:22:03 PST)
• NESTING, DAVID M (SBCSI)
  • RE: Re[2]: Strange Traffic.. (Fri Nov 30 2001 - 08:56:33 PST)
  • RE: Strange Traffic.. (Thu Nov 29 2001 - 09:06:55 PST)
  • RE: Strange "port scans" from a spoofed IP (Thu Nov 08 2001 - 11:44:54 PST)
  • RE: Strange kernel happenings (Thu Nov 01 2001 - 09:52:10 PST)
• netnerd
  • multiple attempts to login via telnet from multiple IP's ... new worm? (Tue Nov 06 2001 - 02:36:31 PST)
• Nick FitzGerald
  • Re: Possible DDos Network Creation with ssh crc exploit (Tue Nov 13 2001 - 17:46:38 PST)
  • Re: Firewall hits/unknown ports (Wed Nov 07 2001 - 11:45:08 PST)
• Pascal Nobus
  • Re: Questions = Thanks (Wed Nov 21 2001 - 15:18:07 PST)
• Patrick Andry
  • Re: MS-SQL Worm? (Tue Nov 20 2001 - 10:52:43 PST)
• Patrick van Zweden
  • Re: any1 stumbled across eCkit ? (Mon Nov 26 2001 - 14:18:58 PST)
  • any1 stumbled across eCkit ? (Mon Nov 26 2001 - 13:21:43 PST)
• Paul Nasrat
  • Re: MS-SQL Worm? (Tue Nov 20 2001 - 09:09:48 PST)
• Paul Rogers
  • Forwarded mail.... (Thu Nov 22 2001 - 01:57:39 PST)
• Peter Turczak
  • New Worm similar to BadTrans.B? (Wed Nov 28 2001 - 10:15:24 PST)
• Progenit Service S.r.l.
  • Problems with modem hanging up after an intrusion (Tue Nov 06 2001 - 00:18:08 PST)
  • Problems with modem hanging up after an intrusion (Tue Nov 06 2001 - 00:18:08 PST)
• Raistlin
  • W32.Badtrans.B@mm storming my mailservers... (Mon Nov 26 2001 - 11:30:35 PST)
• Reeves, Michael (GEAE, Compaq)
  • RE: Code Red -- AGAIN?!? (Fri Nov 30 2001 - 06:29:44 PST)
• Reilly
  • RE: Nimda Infections (Mon Nov 12 2001 - 21:44:31 PST)
  • RE: Nimda Infections (Mon Nov 12 2001 - 21:12:14 PST)
  • RE: Nimda Infections (Mon Nov 12 2001 - 20:31:16 PST)
• reillyat_private
  • Nimda Infections (Mon Nov 12 2001 - 15:28:06 PST)
• Rob Keown
  • RE: MSLV.exe (Wed Nov 21 2001 - 18:54:14 PST)
  • MSLV.exe (Wed Nov 21 2001 - 14:58:10 PST)
  • RE: new trojan? (Wed Nov 21 2001 - 08:44:14 PST)
  • RE: port 6635 and port 9705 (Wed Nov 14 2001 - 18:45:39 PST)
• Russell Fulton
  • DNS attack triggers snort 'RPC EXPLOIT statdx' alert (Sun Nov 25 2001 - 14:19:07 PST)
  • Nimda Infections and code red resurgence (Tue Nov 13 2001 - 14:17:20 PST)
  • Nimda.E having an impact ?? (Wed Oct 31 2001 - 13:29:13 PST)
  • Re: 33270:trinity connection form port 80 to local machine on port (Wed Oct 31 2001 - 12:12:28 PST)
• Ryan Russell
  • Re: Possible DDos Network Creation with ssh crc exploit (Tue Nov 13 2001 - 21:32:02 PST)
  • RE: Nimda Infections (Tue Nov 13 2001 - 08:25:31 PST)
  • Re: Strange kernel happenings (Thu Nov 01 2001 - 09:54:53 PST)
• Ryan Sweat
  • RE: any1 stumbled across eCkit ? (Thu Nov 29 2001 - 10:25:36 PST)
• Ryan Tucker
  • Re: W32.Badtrans.B@mm storming my mailservers... (Mon Nov 26 2001 - 11:55:45 PST)
• SecLists
  • Re: SSH CRC32? What am I seeing? (Wed Nov 21 2001 - 08:36:02 PST)
• Shaun Dewberry
  • SSH CRC32? What am I seeing? (Wed Nov 21 2001 - 05:49:11 PST)
• sheib
  • Two-Headed Worm - ChinaWorm (analysis) (Mon Nov 05 2001 - 00:06:29 PST)
• Shoten
  • Re: IIS (Possible DoS floating around) (Mon Nov 12 2001 - 11:02:46 PST)
• Stephen
  • Re: Firewall hits/unknown ports (Sun Nov 04 2001 - 18:39:28 PST)
• Steve
  • Code Red -- AGAIN?!? (Thu Nov 29 2001 - 13:46:39 PST)
  • RE: [ALERT] Remote File Execution By Web or Mail: Internet Explorer (Wed Nov 21 2001 - 12:37:07 PST)
  • RE: Posting to Incidents list, was: Re: Help with Nimda.E? (Thu Nov 01 2001 - 19:06:52 PST)
• Steve Halligan
  • RE: possible new Nimda variant (Fri Nov 16 2001 - 08:30:48 PST)
• Tim M. Crawford
  • RE: W32.Badtrans.B@mm storming my mailservers... (Mon Nov 26 2001 - 11:51:59 PST)
• Toby Miller
  • Passive OS Fingerprinting (Fri Nov 09 2001 - 15:41:35 PST)
• Tom Fischer
  • new trojan? (Wed Nov 21 2001 - 03:46:05 PST)
• Valdis.Kletnieksat_private
  • Re: Firewall hits/unknown ports (Sun Nov 04 2001 - 20:13:53 PST)
• Vinay Kudithipudi
  • Re[2]: Strange Traffic.. (Thu Nov 29 2001 - 21:06:37 PST)
  • Strange Traffic.. (Thu Nov 29 2001 - 05:11:51 PST)
• w1re p4ir
  • RE: Nimda Infections (Tue Nov 13 2001 - 07:49:58 PST)
• Yuri Demchenko
  • Re: Need Incident Handling Process Framework (Fri Nov 09 2001 - 12:40:00 PST)
• zeno
  • Re: New Worm similar to BadTrans.B? (Wed Nov 28 2001 - 06:30:51 PST)
  • Re: possible new Nimda variant (Fri Nov 16 2001 - 05:09:50 PST)
• Zlatko Ignjatovic
  • Re: Help with Nimda.E? (Thu Nov 01 2001 - 00:14:41 PST)

Last message date: Sat Dec 01 2001 - 13:50:30 PST
Archived on: Sat Dec 01 2001 - 13:50:30 PST

This archive was generated by hypermail 2b30 : Sat Dec 01 2001 - 13:50:30 PST