More on the Worm

From: Aj Effin Reznor (aj@reznor.com)
Date: 09/18/01 

Message-Id: <200109181852.f8IIqcq08623@reznor.com>
Subject: More on the Worm
To: incidents@securityfocus.com, vuln-dev@securityfocus.com, dc-stuff@treachery.net (dc)
Date: Tue, 18 Sep 2001 11:52:37 -0700 (PDT)
From: Aj Effin Reznor <aj@reznor.com>

Seems this may also be hitting somehow on/over SAMBA.

A colleague (Alien8) had this to say about his SGI Indy
with SAMBA running:

"I started seeing a printout (w/no actual print command)
of the file (not sure why) and realized it was coming
from my indy... there was all sorts of traffic so i ran
tcpdump, and then turned off samba alltogether and it
nearly disappeared (the traffic)"

-aj.