incidents 2002/05
By Author

Starting: Wed May 01 2002 - 08:28:09 PDT
Ending: Fri May 31 2002 - 16:04:47 PDT

• Admiraal, J.E. (CDIV)
  • RE: strange account in Win2k (Tue May 28 2002 - 10:02:41 PDT)
• AJ Decker
  • RE: strange account in Win2k (Tue May 28 2002 - 10:56:31 PDT)
• Allen Smith
  • Re: Strange scans (Sat May 25 2002 - 20:03:43 PDT)
• Alphonse MacDonald
  • Re: Windows Systems Defaced (Tue May 14 2002 - 13:44:18 PDT)
• Andreas Wiesmann
  • strange .ch scan by 195.141.86.145 (Sat May 25 2002 - 07:36:29 PDT)
• Bamm (Robert) Visscher
  • Re: odd scans? (Fri May 24 2002 - 13:34:47 PDT)
• batz
  • Re: Security contacts for cnn,time.com,usatoday,and boston globe needed (Tue May 28 2002 - 14:56:54 PDT)
• Benjamin Tomhave
  • explanation of port 1433 scans... (Thu May 16 2002 - 09:04:07 PDT)
  • RE: Strange TCP headers (Sat May 11 2002 - 10:30:13 PDT)
  • RE: Publishing Nimda Logs (Wed May 08 2002 - 09:15:18 PDT)
• Bill Royds
  • RE: Strange scans (Sun May 26 2002 - 19:25:06 PDT)
• Blake Frantz
  • Worms and CScript/WScript (Tue May 21 2002 - 14:44:34 PDT)
  • RE: Strange scan on 1433 (Tue May 21 2002 - 09:46:49 PDT)
  • FW: exploited win2k box, not quite sure how: (Mon May 20 2002 - 12:24:29 PDT)
• Brenna Primrose
  • RE: Windows Systems Defaced (Fri May 03 2002 - 10:17:47 PDT)
• Brett Glass
  • Re: odd scans? (Wed May 29 2002 - 13:47:56 PDT)
• Brian McWilliams
  • Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com (Wed May 08 2002 - 19:25:03 PDT)
• Bukys, Liudvikas
  • Windows Systems Defaced/destroyed, plus Port 3389 attacks (Mon May 13 2002 - 09:00:25 PDT)
• Butler, Brandon
  • RE: exploited win2k box, not quite sure how: (Mon May 20 2002 - 11:36:52 PDT)
• Chip McClure
  • Re: Got 'em. (was "Re: gw.ocg-corp.com") (Mon May 13 2002 - 15:53:39 PDT)
  • Re: gw.ocg-corp.com (Mon May 13 2002 - 14:56:00 PDT)
• Chris Wilson
  • Re: [unisog] Windows Systems Defaced/destroyed, plus Port 3389 attacks (Mon May 13 2002 - 13:33:36 PDT)
• Christian Vogel
  • Re: continues SCAN Proxy attempt (Fri May 24 2002 - 13:47:02 PDT)
  • Re: gw.ocg-corp.com (Mon May 13 2002 - 15:18:52 PDT)
• Cody Hatch
  • Re: 'rooted' NT/2K boxen? (Thu May 02 2002 - 19:30:16 PDT)
  • Re: 'rooted' NT/2K boxen? (Thu May 02 2002 - 14:46:41 PDT)
• Crist J. Clark
  • Application Scanning 1033/tcp? (Fri May 31 2002 - 14:46:05 PDT)
• Dan Cuthbert
  • Re: strange account in Win2k (Tue May 28 2002 - 09:59:25 PDT)
• Daniel Hay
  • Re: Compromised Win2000 machine. - Follow UP (Thu May 30 2002 - 14:27:41 PDT)
  • Re: Compromised Win2000 machine. (Wed May 29 2002 - 11:05:55 PDT)
  • Compromised Win2000 machine. (Tue May 28 2002 - 13:15:25 PDT)
• Dano
  • RE: Strange TCP headers (Fri May 10 2002 - 23:35:12 PDT)
• Darrin Powell
  • Increased connects to Port 1433 (Tue May 21 2002 - 07:33:07 PDT)
• Dave Dittrich
  • World-wide distributed DoS and "warez" bot networks (fwd) (Fri May 03 2002 - 10:27:08 PDT)
• David Ashwood
  • RE: Windows Systems Defaced (Fri May 03 2002 - 04:42:36 PDT)
• David LaPorte
  • RE: Strange scan on 1433 (Tue May 21 2002 - 08:23:13 PDT)
• Deus, Attonbitus
  • RE: Strange scan on 1433 (Tue May 21 2002 - 10:01:48 PDT)
  • RE: Windows Systems Defaced/destroyed, plus Port 3389 attacks (Fri May 17 2002 - 14:31:25 PDT)
  • Publishing Nimda Logs - Summary (Wed May 08 2002 - 07:35:12 PDT)
  • Publishing Nimda Logs (Tue May 07 2002 - 09:56:28 PDT)
• Dias Sgt Kristin F
  • RE: Strange scan on 1433 (Tue May 21 2002 - 08:23:03 PDT)
• dlaumannat_private
  • RE: strange account in Win2k (Tue May 28 2002 - 15:36:52 PDT)
  • RE: info (Mon May 06 2002 - 14:12:00 PDT)
• Don Weber
  • RE: Compromised Win2000 machine. (Tue May 28 2002 - 15:56:46 PDT)
• dr john halewood
  • Re: Strange scan on 1433 (Tue May 21 2002 - 08:30:01 PDT)
• Dubber, Drew B
  • RE: Worms and CScript/WScript (Tue May 28 2002 - 09:13:23 PDT)
• Dug Song
  • Re: Nimda Infections and code red resurgence (Wed May 08 2002 - 14:33:17 PDT)
• E
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 04:50:01 PDT)
• Edwards, David (JTS)
  • Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com - Wrap up (Wed May 08 2002 - 20:15:25 PDT)
  • RE: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com (Tue May 07 2002 - 22:55:32 PDT)
  • RE: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com (Tue May 07 2002 - 19:50:01 PDT)
  • netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com (Mon May 06 2002 - 17:40:06 PDT)
• George Bakos
  • Re: Strange scan on 1433 (Tue May 21 2002 - 14:45:29 PDT)
• ghb the irrepressible
  • Re: Compromised Win2000 machine. (Tue May 28 2002 - 20:42:17 PDT)
• Glenn Forbes Fleming Larratt
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 08:01:11 PDT)
• Gregory Kane
  • Unusual Message log contents (Mon May 06 2002 - 07:33:49 PDT)
• H C
  • Re: Re[2]: Compromised Win2000 machine. (Fri May 31 2002 - 07:22:42 PDT)
  • Re: Compromised Win2000 machine. (Wed May 29 2002 - 19:09:32 PDT)
  • Re: Compromised Win2000 machine. (Wed May 29 2002 - 13:37:47 PDT)
  • RE: Compromised Win2000 machine. (Wed May 29 2002 - 10:11:17 PDT)
  • parsing output from tools (Tue May 28 2002 - 18:35:05 PDT)
  • Re: Compromised Win2000 machine. (Tue May 28 2002 - 14:35:00 PDT)
  • Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com (Tue May 07 2002 - 10:25:35 PDT)
  • Re: 'rooted' NT/2K boxen? (Fri May 03 2002 - 06:54:15 PDT)
  • RE: Windows Systems Defaced (Fri May 03 2002 - 05:28:29 PDT)
  • Re: 'rooted' NT/2K boxen? (Thu May 02 2002 - 15:42:39 PDT)
  • Re: 'rooted' NT/2K boxen? (Thu May 02 2002 - 13:26:18 PDT)
  • 'rooted' NT/2K boxen? (Thu May 02 2002 - 10:31:04 PDT)
• Head of the Councel of Wizards
  • RE: info (Tue May 07 2002 - 07:05:13 PDT)
• Hugo van der Kooij
  • continues SCAN Proxy attempt (Fri May 24 2002 - 13:18:12 PDT)
  • Re: Got 'em. (was "Re: gw.ocg-corp.com") (Mon May 13 2002 - 15:57:47 PDT)
  • Re: Publishing Nimda Logs (Tue May 07 2002 - 23:01:41 PDT)
• James
  • RE: Strange scan on 1433 (Tue May 21 2002 - 12:06:51 PDT)
• Jason Robertson
  • Re: Strange scan on 1433 (Tue May 21 2002 - 09:25:04 PDT)
  • Re: A friend's cable modem Linux machine just got compromised (Wed May 01 2002 - 09:11:21 PDT)
• Javier Sanchez (Information Systems)
  • SQLSnake email account shutdown? (Tue May 28 2002 - 08:34:32 PDT)
• Jensenne Roculan
  • Dead Thread - Publishing Nimda Logs (Thu May 09 2002 - 09:01:00 PDT)
• Jim Harrison (SPG)
  • RE: Publishing Nimda Logs - Summary (Wed May 08 2002 - 11:39:05 PDT)
• jlewisat_private
  • Re: Publishing Nimda Logs (Tue May 07 2002 - 22:56:58 PDT)
• Joe Blatz
  • GET /proxy-test.php (Sun May 26 2002 - 10:14:12 PDT)
• Joe T.
  • RE: info (Fri May 03 2002 - 15:59:30 PDT)
  • Re: info (Fri May 03 2002 - 18:05:19 PDT)
  • info (Fri May 03 2002 - 15:26:49 PDT)
• Johannes B. Ullrich
  • RE: Windows Systems Defaced (Fri May 03 2002 - 11:43:56 PDT)
• Johannes Ullrich
  • Re: Strange scan on 1433 (Tue May 21 2002 - 12:26:37 PDT)
• John Campbell
  • RE: Decrease in 1433 Scans? (Thu May 23 2002 - 10:30:38 PDT)
• John Jasen
  • Re: exploited win2k box, not quite sure how: (Mon May 20 2002 - 13:44:00 PDT)
  • exploited win2k box, not quite sure how: (Fri May 17 2002 - 18:05:29 PDT)
• John Kristoff
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 03:45:03 PDT)
• Jordan K Wiens
  • Re: gw.ocg-corp.com (Mon May 13 2002 - 14:54:58 PDT)
• Joris De Donder
  • Re[2]: Compromised Win2000 machine. (Fri May 31 2002 - 06:55:17 PDT)
• Jose Nazario
  • Re: info (Mon May 06 2002 - 11:25:27 PDT)
• Justin Shore
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 11:31:23 PDT)
• Keith T. Morgan
  • RE: Increased connects to Port 1433 (Tue May 21 2002 - 08:30:09 PDT)
• Ken Hodges
  • Strange "shotgun" scan (Thu May 09 2002 - 10:30:09 PDT)
• Ken Pfeil
  • RE: Strange scan on 1433 (Tue May 21 2002 - 08:19:00 PDT)
• Kevin
  • Re: strange account in Win2k (Tue May 28 2002 - 14:20:13 PDT)
• Keyser Soze
  • Re: GET /proxy-test.php (Tue May 28 2002 - 08:06:59 PDT)
• Kit
  • RE: strange account in Win2k (Tue May 28 2002 - 15:08:16 PDT)
  • RE: Compromised Win2000 machine. (Tue May 28 2002 - 14:48:27 PDT)
• KJK::Hyperion
  • Re: 'rooted' NT/2K boxen? (Fri May 03 2002 - 17:24:59 PDT)
• Kyle R. Hofmann
  • Re: odd scans? (Fri May 24 2002 - 11:21:24 PDT)
• Lance Spitzner
  • Reverse Challenge - Binary released (Sun May 05 2002 - 19:05:46 PDT)
  • Honeynet Project -> The Reverse Challenge (Wed May 01 2002 - 13:11:14 PDT)
• Larry Thompson
  • RE: Strange "shotgun" scan (Thu May 09 2002 - 14:40:05 PDT)
• Lee_Fisherat_private
  • RE: Increased connects to Port 1433 (Tue May 21 2002 - 08:25:37 PDT)
• List-Collector
  • RE: strange .ch scan by 195.141.86.145 (Mon May 27 2002 - 04:42:07 PDT)
• Liston, Kevin C, SOLCM
  • RE: New Stacheldraht? (Wed May 29 2002 - 12:44:31 PDT)
• Loki
  • RE: info (Fri May 03 2002 - 15:41:17 PDT)
• loon
  • Re: Decrease in 1433 Scans? (Thu May 23 2002 - 09:59:40 PDT)
• Mally Mclane
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 11:48:53 PDT)
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 08:47:05 PDT)
• Mark Fagan
  • RE: strange account in Win2k (Wed May 29 2002 - 02:23:25 PDT)
  • strange account in Win2k (Tue May 28 2002 - 08:29:37 PDT)
• Mark Newby
  • Re: Compromised Win2000 machine. (Wed May 29 2002 - 13:38:00 PDT)
  • Re: Unusual Message log contents (Wed May 08 2002 - 05:13:40 PDT)
  • Tuxkit (Optic Kit?) -cracked (/dev/tux) (Thu May 02 2002 - 03:54:25 PDT)
• Matt Barton
  • Decrease in 1433 Scans? (Thu May 23 2002 - 09:38:13 PDT)
• Matt Zimmerman
  • Re: odd scans? (Fri May 24 2002 - 12:13:02 PDT)
  • Re: Strange TCP headers (Fri May 10 2002 - 09:17:38 PDT)
  • Re: ssh scans using username 'test' or 'oracle'? (Thu May 02 2002 - 13:39:54 PDT)
  • ssh scans using username 'test' or 'oracle'? (Thu May 02 2002 - 08:14:01 PDT)
• Matt.Carpenterat_private
  • Re: explanation of port 1433 scans... (Thu May 16 2002 - 11:17:36 PDT)
• Maxime Ducharme
  • Re: strange account in Win2k (Tue May 28 2002 - 13:01:15 PDT)
• McCammon, Keith
  • RE: Security contacts for cnn,time.com,usatoday,and boston globe needed (Tue May 28 2002 - 10:44:21 PDT)
  • RE: exploited win2k box, not quite sure how: (Mon May 20 2002 - 11:39:24 PDT)
  • RE: Strange "shotgun" scan (Thu May 09 2002 - 11:21:19 PDT)
• Michael Wright
  • RE: Worms and CScript/WScript (Tue May 21 2002 - 16:25:47 PDT)
• Michel Arboi
  • Re: Strange TCP headers (Sat May 11 2002 - 00:32:54 PDT)
  • Re: info (Sat May 04 2002 - 01:56:56 PDT)
• Mike Lewinski
  • Re: exploited win2k box, not quite sure how: (Mon May 20 2002 - 12:13:32 PDT)
• MIS Department
  • Re: Decrease in 1433 Scans? (Thu May 23 2002 - 10:22:24 PDT)
• Muhammad Faisal Rauf Danka
  • Re: Application Scanning 1033/tcp? (Fri May 31 2002 - 15:16:04 PDT)
• Ned Lowe
  • Re: Application Scanning 1033/tcp? (Fri May 31 2002 - 15:54:37 PDT)
• netscienceat_private
  • gw.ocg-corp.com (Mon May 13 2002 - 14:43:28 PDT)
• Nick FitzGerald
  • RE: Worms and CScript/WScript (Sun May 26 2002 - 20:07:00 PDT)
  • RE: Worms and CScript/WScript (Tue May 21 2002 - 22:04:30 PDT)
  • Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com (Tue May 07 2002 - 18:19:27 PDT)
• Pascal C. Kocher
  • AW: strange .ch scan by 195.141.86.145 (Tue May 28 2002 - 00:03:32 PDT)
• Patrick Andry
  • Re: Compromised Win2000 machine. (Wed May 29 2002 - 14:05:26 PDT)
• Pavel Lozhkin
  • Strange scan on 1433 (Tue May 21 2002 - 06:38:03 PDT)
• pbsarnacat_private
  • RE: Strange TCP headers (Fri May 10 2002 - 09:38:14 PDT)
  • Strange TCP headers (Fri May 10 2002 - 08:40:19 PDT)
• Pour, Matthew
  • RE: Increased connects to Port 1433 (Tue May 21 2002 - 08:21:26 PDT)
• Quarantine
  • RE: Strange scan on 1433 (Tue May 21 2002 - 08:22:42 PDT)
• Rainer Duffner
  • Re: AW: strange .ch scan by 195.141.86.145 (Thu May 30 2002 - 11:02:51 PDT)
  • Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com (Wed May 08 2002 - 01:39:13 PDT)
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 01:28:40 PDT)
  • Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com (Tue May 07 2002 - 09:12:09 PDT)
• Richard H. Cotterell
  • RE: Worms and CScript/WScript (Mon May 27 2002 - 18:38:47 PDT)
  • RE: Worms and CScript/WScript (Sun May 26 2002 - 07:57:20 PDT)
• Richard.Smithat_private
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 09:38:49 PDT)
• Rick Darsey
  • RE: strange account in Win2k (Tue May 28 2002 - 10:34:24 PDT)
• Robert Buckley
  • New Stacheldraht? (Wed May 29 2002 - 08:14:48 PDT)
  • RE: Strange TCP headers (Fri May 10 2002 - 10:40:04 PDT)
  • RE: Strange TCP headers (Fri May 10 2002 - 09:00:32 PDT)
• Ron Yount
  • RE: exploited win2k box, not quite sure how: (Mon May 20 2002 - 11:44:54 PDT)
• rulerpen
  • Re: exploited win2k box, not quite sure how: (Mon May 20 2002 - 11:58:35 PDT)
• Russell Fulton
  • Re: continues SCAN Proxy attempt (Sun May 26 2002 - 17:32:12 PDT)
  • New nimda variant? (Tue Apr 30 2002 - 17:07:14 PDT)
  • New nimda variant? (Tue Apr 30 2002 - 17:58:31 PDT)
• Ryan Russell
  • Re: Worms and CScript/WScript (Tue May 21 2002 - 15:07:20 PDT)
• Salisko, Rick
  • RE: Decrease in 1433 Scans? (Thu May 23 2002 - 10:26:04 PDT)
• Sam Trenholme
  • Re: A friend's cable modem Linux machine just got compromised (Wed May 01 2002 - 13:39:26 PDT)
  • A friend's cable modem Linux machine just got compromised (Wed May 01 2002 - 01:18:57 PDT)
• Scott Fendley
  • Re: exploited win2k box, not quite sure how: (Mon May 20 2002 - 11:47:50 PDT)
• Scott, Michael R.
  • odd scans? (Fri May 24 2002 - 10:16:20 PDT)
• Skinner, Kit
  • RE: Windows Systems Defaced/destroyed, plus Port 3389 attacks (Fri May 17 2002 - 13:14:04 PDT)
• Smith, Donald
  • RE: odd scans? (Sun May 26 2002 - 08:23:51 PDT)
• Stephen Samuel
  • Nimda type attacks with broken GETs (Mon May 13 2002 - 22:38:02 PDT)
• Stephen W. Thompson
  • Re: Windows Systems Defaced (Thu May 02 2002 - 20:00:01 PDT)
• Steve Zenone
  • RE: Publishing Nimda Logs (Wed May 08 2002 - 11:48:27 PDT)
  • RE: Windows Systems Defaced (Thu May 02 2002 - 20:23:56 PDT)
  • Windows Systems Defaced (Thu May 02 2002 - 13:23:03 PDT)
• Thomas Frerichs
  • Re: Publishing Nimda Logs (Wed May 08 2002 - 10:40:24 PDT)
• Tom Pope
  • RE: Increased connects to Port 1433 (Tue May 21 2002 - 08:42:05 PDT)
• Tracey Losco
  • Re: Increased connects to Port 1433 (Tue May 21 2002 - 08:30:48 PDT)
• Travis Pugh
  • Re: Increased connects to Port 1433 (Tue May 21 2002 - 11:09:58 PDT)
• verbalat_private
  • RE: Worms and CScript/WScript (Tue May 21 2002 - 15:17:37 PDT)
• vogtat_private
  • AW: Publishing Nimda Logs (Wed May 08 2002 - 01:26:27 PDT)
• W.G. Iyer
  • Re: info (Fri May 03 2002 - 17:27:17 PDT)
• Will Aoki
  • Re: gw.ocg-corp.com (Mon May 13 2002 - 15:19:45 PDT)
  • Re: ssh scans using username 'test' or 'oracle'? (Thu May 02 2002 - 10:55:09 PDT)
• William N. Zanatta
  • Re: 'rooted' NT/2K boxen? (Thu May 02 2002 - 13:57:23 PDT)
  • Re: A friend's cable modem Linux machine just got compromised (Thu May 02 2002 - 06:12:45 PDT)
• wirepair
  • Interesting scan to ports 1999-2000 (Thu May 23 2002 - 03:46:33 PDT)
  • 1999-2000 oops (Thu May 23 2002 - 03:52:30 PDT)
• zeno
  • Security contacts for cnn,time.com,usatoday,and boston globe needed (Tue May 28 2002 - 09:15:19 PDT)
  • Re: 'rooted' NT/2K boxen? (Thu May 02 2002 - 13:06:30 PDT)

Last message date: Fri May 31 2002 - 16:04:47 PDT
Archived on: Fri May 31 2002 - 16:04:49 PDT

This archive was generated by hypermail 2b30 : Fri May 31 2002 - 16:04:49 PDT