Re: DCOM worm analysis report: W32.Blaster.Worm

On Tue, 12 Aug 2003 10:11:03 +0200, Andrew Thomas <andrew@generator.co.za> said:

> If the information contained herein is still correct, then it would appear that

That may have been true in the first half hour or so. Just remember that the *first* time the worm hops to another /8, it will start creating another large concentration around THAT address range... and inside 30 minutes there's too many pools to count.

Another way to look at it - by the time you started seeing "me too" postings that *something* was up, it had gotten out of the original ranges (remember that the "me toos" are in general evidence that it's left the original range)