Re: strange cmd.exe access

From: adam (eggroidat_private)
Date: Fri May 30 2003 - 16:23:02 PDT

Next message: John McCracken: "RE: Dubious e-mail: [Fwd: Dell.com (Password Request)]"

Previous message: Rob Shein: "RE: Dubious e-mail: [Fwd: Dell.com (Password Request)]"
In reply to: Jeff Adams: "RE: strange cmd.exe access"
Next in thread: Frank Knobbe: "RE: strange cmd.exe access"
Next in thread: H Carvey: "Re: strange cmd.exe access"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

>
>
>I have been seeing similar odd cmd.exe packets as well.=20
>
>It looks like part of a Code Red or a new variant.
>
>Anyone else seeing the same?
>
>----------------------------------------------------------------------------
>----------------------------------------------------------------------------
>

I don't have the logs here at home, but I know I've seen this a couple 
of times.  We have ManHunt deployed, and it logs it as "Bad utf-8." 


----------------------------------------------------------------------------
----------------------------------------------------------------------------

Next message: John McCracken: "RE: Dubious e-mail: [Fwd: Dell.com (Password Request)]"
Previous message: Rob Shein: "RE: Dubious e-mail: [Fwd: Dell.com (Password Request)]"
In reply to: Jeff Adams: "RE: strange cmd.exe access"
Next in thread: Frank Knobbe: "RE: strange cmd.exe access"
Next in thread: H Carvey: "Re: strange cmd.exe access"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Jun 01 2003 - 21:58:26 PDT