Re: Nimda.E/unknown memory resident, internet-aware processes
From: Johannes Ullrich (jullrich@euclidian.com)
Date: 03/20/03
- Previous message: Matt Hornsby: "Nimda.E/unknown memory resident, internet-aware processes"
- In reply to: Matt Hornsby: "Nimda.E/unknown memory resident, internet-aware processes"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 20 Mar 2003 11:03:05 -0500 From: "Johannes Ullrich" <jullrich@euclidian.com> To: "Matt Hornsby" <mr.hornsby@attbi.com>
> Anyone seen this before?
typical 'botnet'. Not sure which code they are using, but this basic
setup is very common.
The fact that the machine got eventually infected with Nimda just
shows that it was vulnerable all along. Finding multiple backdoors
on machines like this is common.
-- -------------------------------------------------------------------- jullrich@euclidian.com Collaborative Intrusion Detection join http://www.dshield.org ---------------------------------------------------------------------------- <Pre>Lose another weekend managing your IDS? Take back your personal time. 15-day free trial of StillSecure Border Guard.</Pre> <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
- Previous message: Matt Hornsby: "Nimda.E/unknown memory resident, internet-aware processes"
- In reply to: Matt Hornsby: "Nimda.E/unknown memory resident, internet-aware processes"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
