On Mon, 18 Aug 2003, Ken Eichman wrote: > A number of people have informed me that this traffic is probably > generated by a "good samaritan" worm apparently named 'Msblast.d' > or 'Welchia' (Symantec) or 'Nachi' (Mcafee), which removes msblast It might be my over-paranoid nature, but I think that labeling this, or any other worm, as a good samaritan worm is dangerous. We have no way of verifying or holding the author accountable, and it may be that some hostile functionality exists in the worm and it is simply patching to protect itself. D --------------------------------------------------------------------------- Captus Networks - Integrated Intrusion Prevention and Traffic Shaping - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans - Automatically Control P2P, IM and Spam Traffic - Ensure Reliable Performance of Mission Critical Applications - Precisely Define and Implement Network Security and Performance Policies **FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo Visit us at: http://www.securityfocus.com/sponsor/CaptusNetworks_incidents_030814 ----------------------------------------------------------------------------
This archive was generated by hypermail 2b30 : Mon Aug 18 2003 - 13:07:33 PDT