Re: NIMDA - ceased ? -

From: Neil Dickey <neil(at)geol.niu.edu>
Date: Fri Dec 27 2002 - 12:25:35 EST

Tomo <tomo@c-wind.com> wrote asking:

>Is NIMDA ...(GET /scripts/..%252f../winnt/system32 ...something)

No, not around here anyway. My latest hit was this morning, the 27th. I will say that traffic levels for this one are somewhat reduced from what they have been, and days may pass without any hits.

My guess is that what we're seeing now isn't entirely the worm operating, but that the worm's exploit has been incorporated into various scripts.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Fri Dec 27 13:28:24 2002