incidents 2001/11
By Date

Starting: Wed Oct 31 2001 - 12:33:12 PST
Ending: Sat Dec 01 2001 - 13:50:30 PST

• Re: 33270:trinity connection form port 80 to local machine on port Russell Fulton (Wed Oct 31 2001 - 12:12:28 PST)
• Nimda.E having an impact ?? Russell Fulton (Wed Oct 31 2001 - 13:29:13 PST)
• Re: Help with Nimda.E? Zlatko Ignjatovic (Thu Nov 01 2001 - 00:14:41 PST)
• Re: Should I be concerned about? (long reply, grab a sandwich) Chris Brenton (Thu Nov 01 2001 - 06:05:46 PST)
• Strange kernel happenings mstevensonat_private (Thu Nov 01 2001 - 09:12:20 PST)
• FW: Help with Nimda.E? Matt Beck (Thu Nov 01 2001 - 08:56:29 PST)
• Posting to Incidents list, was: Re: Help with Nimda.E? H C (Thu Nov 01 2001 - 09:18:36 PST)
• Re: Should I be concerned about? Jose Carlos Faial (Thu Nov 01 2001 - 09:05:12 PST)
• RE: Strange kernel happenings NESTING, DAVID M (SBCSI) (Thu Nov 01 2001 - 09:52:10 PST)
• Re: Strange kernel happenings Ryan Russell (Thu Nov 01 2001 - 09:54:53 PST)
• Re: Posting to Incidents list, was: Re: Help with Nimda.E? Dan Ellis (Thu Nov 01 2001 - 10:17:01 PST)
• RE: Strange kernel happenings Boyan Krosnov (Thu Nov 01 2001 - 11:28:51 PST)
• Re: Posting to Incidents list, was: Re: Help with Nimda.E? cambriaat_private (Thu Nov 01 2001 - 13:28:55 PST)
• RE: Posting to Incidents list, was: Re: Help with Nimda.E? Steve (Thu Nov 01 2001 - 19:06:52 PST)
• Strange connections to ports 1214, 6346 and 28800 Jeroen Peters (Fri Nov 02 2001 - 02:10:16 PST)
• Re: Strange connections to ports 1214, 6346 and 28800 Glenn Forbes Fleming Larratt (Fri Nov 02 2001 - 08:47:45 PST)
• Firewall hits/unknown ports bonkat_private (Sun Nov 04 2001 - 07:06:04 PST)
• Re: Firewall hits/unknown ports Stephen (Sun Nov 04 2001 - 18:39:28 PST)
• Re: Firewall hits/unknown ports Glenn Forbes Fleming Larratt (Sun Nov 04 2001 - 19:28:29 PST)
• RE: Firewall hits/unknown ports Loki (Sun Nov 04 2001 - 20:00:01 PST)
• Re: Firewall hits/unknown ports Valdis.Kletnieksat_private (Sun Nov 04 2001 - 20:13:53 PST)
• Re: Firewall hits/unknown ports freeholdat_private (Mon Nov 05 2001 - 07:59:54 PST)
• Re: Bogus Email hvdkooijat_private (Sun Nov 04 2001 - 22:50:13 PST)
• RE: Firewall hits/unknown ports Barber, Chris (Mon Nov 05 2001 - 05:04:55 PST)
• Two-Headed Worm - ChinaWorm (analysis) sheib (Mon Nov 05 2001 - 00:06:29 PST)
• Re: Two-Headed Worm - ChinaWorm (analysis) Holger van Lengerich (Mon Nov 05 2001 - 07:59:51 PST)
• Re: Two-Headed Worm - ChinaWorm (analysis) Dave Dittrich (Mon Nov 05 2001 - 10:42:29 PST)
• Re: Firewall hits/unknown ports Nick FitzGerald (Wed Nov 07 2001 - 11:45:08 PST)
• Problems with modem hanging up after an intrusion Progenit Service S.r.l. (Tue Nov 06 2001 - 00:18:08 PST)
• Strange "port scans" from a spoofed IP Jon R. Kibler (Mon Nov 05 2001 - 15:37:04 PST)
• E-mail with ties to possible malicious website Michael B. Morell (Tue Nov 06 2001 - 09:15:15 PST)
• RE: Strange "port scans" from a spoofed IP NESTING, DAVID M (SBCSI) (Thu Nov 08 2001 - 11:44:54 PST)
• RE: E-mail with ties to possible malicious website -MORE Michael B. Morell (Thu Nov 08 2001 - 11:54:31 PST)
• Problems with modem hanging up after an intrusion Progenit Service S.r.l. (Tue Nov 06 2001 - 00:18:08 PST)
• RE: Problems with modem hanging up after an intrusion McCammon, Keith (Thu Nov 08 2001 - 12:39:15 PST)
• multiple attempts to login via telnet from multiple IP's ... new worm? netnerd (Tue Nov 06 2001 - 02:36:31 PST)
• Corrupted Directories, Intrusions, and Nimda Oh MY Drew E. Gilkey (Thu Nov 08 2001 - 17:48:30 PST)
• Re: Corrupted Directories, Intrusions, and Nimda Oh MY Lew E. Lefton (Thu Nov 08 2001 - 20:38:30 PST)
• Re: Corrupted Directories, Intrusions, and Nimda Oh MY Mike Lewinski (Thu Nov 08 2001 - 21:29:54 PST)
• Analysis of SSH crc32 compensation attack detector exploit Dave Dittrich (Thu Nov 08 2001 - 23:32:32 PST)
• Re: Corrupted Directories, Intrusions, and Nimda Oh MY H C (Fri Nov 09 2001 - 03:54:31 PST)
• Re: SYN Flood attack with sequential destination ports? Joerg Over (Thu Nov 08 2001 - 11:08:50 PST)
• RE: Strange "port scans" from a spoofed IP Keith.Morgan (Fri Nov 09 2001 - 07:58:10 PST)
• Re: Corrupted Directories, Intrusions, and Nimda Oh MY Mike Shaw (Fri Nov 09 2001 - 07:13:29 PST)
• Need Incident Handling Process Framework J Jewitt (Fri Nov 09 2001 - 08:48:47 PST)
• Strange TCP Sweep to 0.0.0.0 Geoff Poer (Fri Nov 09 2001 - 09:34:30 PST)
• Analysis of SSH crc32 compensation attack detector exploit Dave Dittrich (Thu Nov 08 2001 - 23:32:32 PST)
• Re: multiple attempts to login via telnet from multiple IP's ... new worm? Nathan Einwechter (Thu Nov 08 2001 - 18:12:21 PST)
• RE: Network and Incident Symbology: Comments Wanted Becky Bace (Fri Nov 09 2001 - 12:14:35 PST)
• Re: Analysis of SSH crc32 compensation attack detector exploit Dave Dittrich (Fri Nov 09 2001 - 13:03:34 PST)
• Re: Need Incident Handling Process Framework Yuri Demchenko (Fri Nov 09 2001 - 12:40:00 PST)
• Re: Need Incident Handling Process Framework H C (Fri Nov 09 2001 - 11:48:44 PST)
• RE: SYN Flood attack with sequential destination ports? Joshua Wright (Fri Nov 09 2001 - 12:28:15 PST)
• Passive OS Fingerprinting Toby Miller (Fri Nov 09 2001 - 15:41:35 PST)
• RE: Strange IIS behavior, Keith.Morgan (Mon Nov 12 2001 - 08:12:37 PST)
• RE: Strange "port scans" from a spoofed IP Jason Robertson (Sun Nov 11 2001 - 15:55:33 PST)
• IIS (Possible DoS floating around) Keith.Morgan (Mon Nov 12 2001 - 09:27:13 PST)
• Re: IIS (Possible DoS floating around) Mike Shaw (Mon Nov 12 2001 - 10:03:06 PST)
• RE: IIS (Possible DoS floating around) Keith.Morgan (Mon Nov 12 2001 - 10:18:27 PST)
• Re: IIS (Possible DoS floating around) Shoten (Mon Nov 12 2001 - 11:02:46 PST)
• Re: IIS (Possible DoS floating around) Ezequiel Diaz-Pacheco (Mon Nov 12 2001 - 13:58:55 PST)
• sub-7 Leon de France (Mon Nov 12 2001 - 11:28:15 PST)
• Re: sub-7 Neil Dickey (Mon Nov 12 2001 - 14:22:03 PST)
• RE: IIS (Possible DoS floating around) Keith.Morgan (Mon Nov 12 2001 - 11:12:39 PST)
• Nimda Infections reillyat_private (Mon Nov 12 2001 - 15:28:06 PST)
• RE: Nimda Infections Dial Joe (Mon Nov 12 2001 - 16:46:13 PST)
• RE: Nimda Infections Jim Harrison (SPG) (Mon Nov 12 2001 - 16:52:29 PST)
• Re: sub-7 Brice Carlson (Mon Nov 12 2001 - 18:42:59 PST)
• Re: sub-7 Nathan Einwechter (Mon Nov 12 2001 - 19:36:52 PST)
• RE: Nimda Infections Reilly (Mon Nov 12 2001 - 20:31:16 PST)
• RE: Nimda Infections Reilly (Mon Nov 12 2001 - 21:12:14 PST)
• RE: Nimda Infections Reilly (Mon Nov 12 2001 - 21:44:31 PST)
• RE: Nimda Infections Jim Howard (Tue Nov 13 2001 - 06:31:41 PST)
• RE: Nimda Infections w1re p4ir (Tue Nov 13 2001 - 07:49:58 PST)
• Re: Strange TCP Sweep to 0.0.0.0 jared mc (Tue Nov 13 2001 - 08:04:37 PST)
• RE: Nimda Infections Ryan Russell (Tue Nov 13 2001 - 08:25:31 PST)
• Re: sub-7 John Sage (Tue Nov 13 2001 - 08:41:58 PST)
• RE: Nimda Infections Neil Dickey (Tue Nov 13 2001 - 09:03:12 PST)
• Nimda Infections and code red resurgence Russell Fulton (Tue Nov 13 2001 - 14:17:20 PST)
• A Snapshot of Global Internet Worm Activity Dug Song (Tue Nov 13 2001 - 12:34:22 PST)
• Possible DDos Network Creation with ssh crc exploit Mike Grantham (Tue Nov 13 2001 - 15:28:17 PST)
• Re: Possible DDos Network Creation with ssh crc exploit Jose Nazario (Tue Nov 13 2001 - 16:14:55 PST)
• Re: Possible DDos Network Creation with ssh crc exploit Nick FitzGerald (Tue Nov 13 2001 - 17:46:38 PST)
• Strange SMTP Garbage Flood Mike Tibor (Tue Nov 13 2001 - 17:52:28 PST)
• Re: Strange SMTP Garbage Flood macdaddyat_private (Tue Nov 13 2001 - 18:20:53 PST)
• Re: Possible DDos Network Creation with ssh crc exploit Ryan Russell (Tue Nov 13 2001 - 21:32:02 PST)
• SUB7 (update) Now Netbus too! Brice Carlson (Tue Nov 13 2001 - 20:23:15 PST)
• RE: SUB7 (update) Now Netbus too! Davis, Scott (Wed Nov 14 2001 - 08:36:53 PST)
• Re: SUB7 (update) Now Netbus too! gattaca (Wed Nov 14 2001 - 09:12:44 PST)
• RE: SUB7 (update) Now Netbus too! Davis, Scott (Wed Nov 14 2001 - 09:27:02 PST)
• RE: SUB7 (update) Now Netbus too! Fernando Cardoso (Wed Nov 14 2001 - 09:07:37 PST)
• port 6635 and port 9705 Jim Howard (Wed Nov 14 2001 - 09:29:08 PST)
• Re: Analysis of SSH crc32 compensation attack detector exploit Dave Dittrich (Wed Nov 14 2001 - 10:21:49 PST)
• Re: Strange SMTP Garbage Flood Duncan Simpson (Wed Nov 14 2001 - 08:49:35 PST)
• Re: Strange SMTP Garbage Flood Johannes Verelst (Wed Nov 14 2001 - 13:11:08 PST)
• Re: Analysis of SSH crc32 compensation attack detector exploit Dave Dittrich (Wed Nov 14 2001 - 10:21:49 PST)
• RE: port 6635 and port 9705 Rob Keown (Wed Nov 14 2001 - 18:45:39 PST)
• RE: port 6635 and port 9705 dschultzat_private (Thu Nov 15 2001 - 00:52:31 PST)
• possible new Nimda variant Howard Gleason (Fri Nov 16 2001 - 05:53:01 PST)
• RE: possible new Nimda variant Steve Halligan (Fri Nov 16 2001 - 08:30:48 PST)
• Re: possible new Nimda variant zeno (Fri Nov 16 2001 - 05:09:50 PST)
• strange log john.huckat_private (Fri Nov 16 2001 - 12:09:01 PST)
• Announcement: New Maillist - Honeypots Lance Spitzner (Mon Nov 19 2001 - 08:52:23 PST)
• MS-SQL Worm? Douglas P. Brown (Tue Nov 20 2001 - 06:54:18 PST)
• Re: MS-SQL Worm? Paul Nasrat (Tue Nov 20 2001 - 09:09:48 PST)
• Re: MS-SQL Worm? Arthur Donkers (Tue Nov 20 2001 - 08:47:16 PST)
• Re: MS-SQL Worm? Arthur Donkers (Tue Nov 20 2001 - 10:50:10 PST)
• Re: MS-SQL Worm? Patrick Andry (Tue Nov 20 2001 - 10:52:43 PST)
• Re: MS-SQL Worm? Johannes Verelst (Tue Nov 20 2001 - 11:11:20 PST)
• Re: MS-SQL Worm? Arthur Donkers (Tue Nov 20 2001 - 08:40:02 PST)
• Re: MS-SQL Worm? jabba (Tue Nov 20 2001 - 09:24:30 PST)
• Fragmentation Concerns... Josh Lutz (Tue Nov 20 2001 - 10:18:26 PST)
• Re: MS-SQL Worm? incidents-return-2127-jwa=jammed.comat_private (Tue Nov 20 2001 - 12:27:39 PST)
• SSH CRC32? What am I seeing? Shaun Dewberry (Wed Nov 21 2001 - 05:49:11 PST)
• Questions Ihsahn Diablo (Wed Nov 21 2001 - 04:54:02 PST)
• new trojan? Tom Fischer (Wed Nov 21 2001 - 03:46:05 PST)
• Re: SSH CRC32? What am I seeing? SecLists (Wed Nov 21 2001 - 08:36:02 PST)
• RE: new trojan? Rob Keown (Wed Nov 21 2001 - 08:44:14 PST)
• Re: SSH CRC32? What am I seeing? Jose Nazario (Wed Nov 21 2001 - 09:19:59 PST)
• Re: new trojan? Johannes Verelst (Wed Nov 21 2001 - 10:01:23 PST)
• Re: Questions Aaron (Wed Nov 21 2001 - 10:18:25 PST)
• Re: Questions Mike Lewinski (Wed Nov 21 2001 - 10:39:58 PST)
• [ALERT] Remote File Execution By Web or Mail: Internet Explorer hush.little.babyat_private (Wed Nov 21 2001 - 11:12:00 PST)
• Re: SSH CRC32? What am I seeing? Martin Roesch (Wed Nov 21 2001 - 13:03:52 PST)
• RE: [ALERT] Remote File Execution By Web or Mail: Internet Explorer Steve (Wed Nov 21 2001 - 12:37:07 PST)
• RE: Questions = Thanks Ihsahn Diablo (Wed Nov 21 2001 - 13:19:44 PST)
• MSLV.exe Rob Keown (Wed Nov 21 2001 - 14:58:10 PST)
• Re: Questions = Thanks Pascal Nobus (Wed Nov 21 2001 - 15:18:07 PST)
• Re: [unisog] MS-SQL Worm? Jeff Anderson-Lee (Wed Nov 21 2001 - 13:25:20 PST)
• RE: MSLV.exe Rob Keown (Wed Nov 21 2001 - 18:54:14 PST)
• Forwarded mail.... Paul Rogers (Thu Nov 22 2001 - 01:57:39 PST)
• Re: Questions = Thanks Devdas Bhagat (Wed Nov 21 2001 - 22:17:06 PST)
• More ssh attempts Marco Slaviero (Thu Nov 22 2001 - 01:24:43 PST)
• Re: More ssh attempts gabriel rosenkoetter (Thu Nov 22 2001 - 11:30:56 PST)
• Re: More ssh attempts Homer Wilson Smith (Thu Nov 22 2001 - 16:46:20 PST)
• Re: Forwarded mail.... Kaneda Akira (Thu Nov 22 2001 - 13:05:13 PST)
• Re: More ssh attempts Marco Slaviero (Fri Nov 23 2001 - 01:17:53 PST)
• Need Urgent Info about SQL Worm Matthias Merkel (Thu Nov 22 2001 - 18:24:11 PST)
• Re: Need Urgent Info about SQL Worm Arthur Donkers (Fri Nov 23 2001 - 08:38:23 PST)
• Re: [ALERT] Remote File Execution By Web or Mail: Internet Explorer Markus Kern (Fri Nov 23 2001 - 08:18:41 PST)
• DNS attack triggers snort 'RPC EXPLOIT statdx' alert Russell Fulton (Sun Nov 25 2001 - 14:19:07 PST)
• Possible Trojan/Virus: while.com. Jay D. Dyson (Sun Nov 25 2001 - 22:21:58 PST)
• Re: Possible Trojan/Virus: while.com. joshbat_private (Mon Nov 26 2001 - 09:23:34 PST)
• RE: Possible Trojan/Virus: while.com. Fernando Cardoso (Mon Nov 26 2001 - 08:45:51 PST)
• Re: Possible Trojan/Virus: while.com. John Sage (Mon Nov 26 2001 - 09:46:27 PST)
• Re: Possible Trojan/Virus: while.com. Jay D. Dyson (Mon Nov 26 2001 - 10:07:31 PST)
• W32.Badtrans.B@mm storming my mailservers... Raistlin (Mon Nov 26 2001 - 11:30:35 PST)
• RE: W32.Badtrans.B@mm storming my mailservers... Tim M. Crawford (Mon Nov 26 2001 - 11:51:59 PST)
• Malicious use of grc.com Magniat_private (Mon Nov 26 2001 - 11:53:52 PST)
• Re: W32.Badtrans.B@mm storming my mailservers... Ryan Tucker (Mon Nov 26 2001 - 11:55:45 PST)
• any1 stumbled across eCkit ? Patrick van Zweden (Mon Nov 26 2001 - 13:21:43 PST)
• W32.Badtrans.B@mm Liudvikas Bukys (Mon Nov 26 2001 - 13:30:54 PST)
• Re: W32.Badtrans.B@mm Marc Fossi (Mon Nov 26 2001 - 13:46:48 PST)
• Re: any1 stumbled across eCkit ? Patrick van Zweden (Mon Nov 26 2001 - 14:18:58 PST)
• Re: W32.Badtrans.B@mm Brett Glass (Mon Nov 26 2001 - 14:13:15 PST)
• Re: W32.Badtrans.B@mm John Sage (Mon Nov 26 2001 - 14:46:52 PST)
• Re: any1 stumbled across eCkit ? Ian Jones (Mon Nov 26 2001 - 15:35:36 PST)
• Re: Malicious use of grc.com Blake McNeill (Mon Nov 26 2001 - 23:46:09 PST)
• Re: Malicious use of grc.com gabriel rosenkoetter (Tue Nov 27 2001 - 20:32:10 PST)
• Windows XP - Still has a Windows NT4 DoS hangover? Bob Fryer (Tue Nov 27 2001 - 21:26:24 PST)
• RE: Windows XP - Still has a Windows NT4 DoS hangover? Adcock, Matt (Wed Nov 28 2001 - 08:58:46 PST)
• New Worm similar to BadTrans.B? Peter Turczak (Wed Nov 28 2001 - 10:15:24 PST)
• Re: New Worm similar to BadTrans.B? zeno (Wed Nov 28 2001 - 06:30:51 PST)
• Re: New Worm similar to BadTrans.B? [Virus Checked] Aron_Croftat_private (Wed Nov 28 2001 - 10:35:31 PST)
• Strange Traffic.. Vinay Kudithipudi (Thu Nov 29 2001 - 05:11:51 PST)
• Re: any1 stumbled across eCkit ? Fredrik Ostergren (Thu Nov 29 2001 - 01:55:44 PST)
• RE: Strange Traffic.. NESTING, DAVID M (SBCSI) (Thu Nov 29 2001 - 09:06:55 PST)
• RE: any1 stumbled across eCkit ? Ryan Sweat (Thu Nov 29 2001 - 10:25:36 PST)
• Code Red -- AGAIN?!? Steve (Thu Nov 29 2001 - 13:46:39 PST)
• Re: Code Red -- AGAIN?!? Jay D. Dyson (Thu Nov 29 2001 - 16:15:15 PST)
• Re: Code Red -- AGAIN?!? Chip McClure (Thu Nov 29 2001 - 16:43:10 PST)
• RE: Re[2]: Strange Traffic.. NESTING, DAVID M (SBCSI) (Fri Nov 30 2001 - 08:56:33 PST)
• Re: Code Red -- AGAIN?!? Emre Yildirim (Thu Nov 29 2001 - 21:10:36 PST)
• RE: Code Red -- AGAIN?!? Reeves, Michael (GEAE, Compaq) (Fri Nov 30 2001 - 06:29:44 PST)
• Strange Web requests. Geoffrey King (Fri Nov 30 2001 - 08:01:12 PST)
• Re: Strange Traffic.. John Sage (Thu Nov 29 2001 - 21:26:50 PST)
• solaris nscd cores j.e.r.k. ROCKS (Fri Nov 30 2001 - 05:43:59 PST)
• Re[2]: Strange Traffic.. Vinay Kudithipudi (Thu Nov 29 2001 - 21:06:37 PST)
• RE: Code Red -- AGAIN?!? Grimes, Shawn (NIA/IRP) (Fri Nov 30 2001 - 05:15:59 PST)
• Proxy Scans to dail up hosts... Grimes, Shawn (NIA/IRP) (Fri Nov 30 2001 - 07:14:27 PST)
• Re: Proxy Scans to dail up hosts... Dave Mitchell (Fri Nov 30 2001 - 14:12:01 PST)
• Re: Re[2]: Strange Traffic.. Markus Stumpf (Fri Nov 30 2001 - 14:53:04 PST)
• Re: Code Red -- AGAIN?!? Eric Hall (Fri Nov 30 2001 - 13:34:46 PST)
• Re: Proxy Scans to dial up hosts... Bill_Roydsat_private (Fri Nov 30 2001 - 14:03:49 PST)
• RE: Proxy Scans to dial up hosts... Ascent - Compton, Richard (Fri Nov 30 2001 - 14:34:47 PST)

Last message date: Sat Dec 01 2001 - 13:50:30 PST
Archived on: Sat Dec 01 2001 - 13:50:30 PST

This archive was generated by hypermail 2b30 : Sat Dec 01 2001 - 13:50:30 PST