Re: Re(2): new codered worm penetrates content-filtering

From: Ryan Russell (ryanat_private)
Date: Thu Jan 10 2002 - 12:43:23 PST

Next message: Ryan Russell: "Re: new codered worm penetrates content-filtering"

Previous message: Robert Gile @Agoura: "RE: new codered worm penetrates content-filtering"
In reply to: Ken Eichman: "Re(2): new codered worm penetrates content-filtering"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thu, 10 Jan 2002, Ken Eichman wrote:

> 4E 4E 4E 4E 4E 4E 4E 4E 4E 4E 4E 4E 4E E9 30 39  NNNNNNNNNNNNN.09
> 30 E6 38 35 38 EC 62 64 33 E7 38 30 31 E9 30 39  0.858.bd3.801.09

Note that something has done some decoding there.  This should start out:
NNNNN%u9090%u6858%ucbd3%u7801%u9090%...It's taking youre %uN and
converting it to 0xEN.  Any idea if that's on your end?

					Ryan

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Ryan Russell: "Re: new codered worm penetrates content-filtering"
Previous message: Robert Gile @Agoura: "RE: new codered worm penetrates content-filtering"
In reply to: Ken Eichman: "Re(2): new codered worm penetrates content-filtering"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jan 10 2002 - 14:41:22 PST