Re: CodeRed-like FTP worm?

From: hvdkooijat_private
Date: Thu Dec 13 2001 - 10:11:43 PST

Next message: Jeremy G Byrne: "Gokar Worm?"

Previous message: Philipp Stucke: "Re: Voluminous SSHd scanning; possible worm activity ?"
In reply to: Ascent - Compton, Richard: "CodeRed-like FTP worm?"
Next in thread: Neil McKellar: "Re: CodeRed-like FTP worm?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wed, 12 Dec 2001, Ascent - Compton, Richard wrote:

> I keep seeing attempted connections to ftp by various boxes in the same
> subnets.  Could this be some sort of scan for vulnerable ftp servers?
> Something like a CodeRed ftp worm?

Most likely one of the scanners looking for open FTP servers to store the 
latest warez.

Hugo.

-- 
All email send to me is bound to the rules described on my homepage.
    hvdkooijat_private		http://hvdkooij.xs4all.nl/
	    Don't meddle in the affairs of sysadmins,
	    for they are subtle and quick to anger.


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Jeremy G Byrne: "Gokar Worm?"
Previous message: Philipp Stucke: "Re: Voluminous SSHd scanning; possible worm activity ?"
In reply to: Ascent - Compton, Richard: "CodeRed-like FTP worm?"
Next in thread: Neil McKellar: "Re: CodeRed-like FTP worm?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Dec 13 2001 - 10:22:30 PST