NIMDA Removal

From: Isherwood Jeff C Contr AFRL/IFOSS (Jeffrey.Isherwoodat_private)
Date: Wed Sep 19 2001 - 07:48:15 PDT

Next message: Johannes Verelst: "Re: NIMDA Removal"

Previous message: Allen Smith: "Re: the better worm tutorial"
Next in thread: Johannes Verelst: "Re: NIMDA Removal"
Reply: Johannes Verelst: "Re: NIMDA Removal"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Now that everyone has had a chance to look at it (I'm sure many folks
captured live copies of this bugger).

AV Sites around the world are coming out with tools to fix and remove it.  I
hate those tools.

Sat down and went over everything this one does, based on the live sample
and data on the list, as well as a few contributions from other sources.  I
think I've got it all down now.

Did I miss anything?

text/plain attachment: Nimda_Removal.txt

---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com

Next message: Johannes Verelst: "Re: NIMDA Removal"
Previous message: Allen Smith: "Re: the better worm tutorial"
Next in thread: Johannes Verelst: "Re: NIMDA Removal"
Reply: Johannes Verelst: "Re: NIMDA Removal"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Sep 19 2001 - 09:47:17 PDT