Mailing List Archive For incidents@securityfocus.com Feb 2003 By Author

• Alberto Cozer
  • Re: Web Defacement (Mon Feb 17 2003 - 13:56:25 EST)
• Alexander Reelsen
  • webserver probes for php detection (Thu Feb 13 2003 - 08:10:03 EST)
• Alfred Huger
  • Summary of the responses (4 line ad) (Thu Feb 13 2003 - 16:48:43 EST)
  • The 4 line ad at the bottom of this post.. (Wed Feb 12 2003 - 19:32:12 EST)
• Alif The Terrible
  • Re: FW: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) (Thu Feb 06 2003 - 17:54:32 EST)
• Anders Reed Mohn
  • RE: ALEVRIUS! (Tue Feb 11 2003 - 11:41:23 EST)
  • RE: ALEVRIUS! (Fri Feb 07 2003 - 07:06:47 EST)
• Anders Thulin
  • Re: Weird Profile in Documents and Settings (Fri Feb 21 2003 - 03:20:27 EST)
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Fri Feb 14 2003 - 02:12:18 EST)
• Andy Bastien
  • Re: email address probes (Fri Feb 07 2003 - 12:16:53 EST)
  • email address probes (Wed Feb 05 2003 - 15:54:19 EST)
• Anthony Kim
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Fri Feb 14 2003 - 11:02:41 EST)
• Austin Ehlers
  • RE: Weird Profile in Documents and Settings (Fri Feb 21 2003 - 23:14:48 EST)
• Axel Beckert - ecos gmbh
  • Re: email address probes (Thu Feb 06 2003 - 12:30:15 EST)
• Baklarz, Ron
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 15:01:54 EST)
• bob
  • Re: ICQ problem. (Fri Feb 21 2003 - 23:01:19 EST)
• Bojan Zdrnja
  • Re: Weird Windows logon attempts (Mon Feb 24 2003 - 04:07:55 EST)
• Boyan Krosnov
  • RE: FTP/Port 1038 (Tue Feb 04 2003 - 17:26:41 EST)
• Brad Arlt
  • Re: email address probes (Fri Feb 07 2003 - 12:29:02 EST)
  • Re: email address probes (Wed Feb 05 2003 - 17:26:12 EST)
• Brad Griffin
  • RE: www.nopop.net (Mon Feb 17 2003 - 17:27:01 EST)
• Brenna Primrose
  • RE: Suspicious file on Desktop (Mon Feb 10 2003 - 16:12:24 EST)
• Carmen Tache
  • RE: Weird apache logs (Wed Feb 26 2003 - 14:09:43 EST)
• Charles Hamby
  • TCP 445 Scan? (Thu Feb 27 2003 - 13:25:29 EST)
• Chris Brenton
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Thu Feb 13 2003 - 18:26:46 EST)
• Christian Vogel
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Tue Feb 04 2003 - 13:46:33 EST)
• Christopher Hummert
  • RE: Weird Profile in Documents and Settings (Sat Feb 22 2003 - 16:36:58 EST)
• Christopher Lyon
  • S4T4N1C Web Defacement (Thu Feb 13 2003 - 03:23:40 EST)
• Christopher Wagner
  • Spammers? (Thu Feb 27 2003 - 13:11:08 EST)
• Chuck Swiger
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Tue Feb 11 2003 - 22:00:01 EST)
  • logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Mon Feb 10 2003 - 19:45:53 EST)
• D.C. van Moolenbroek
  • Re: More /sumthin (Wed Feb 26 2003 - 19:59:08 EST)
• Dan Hanson
  • Incident Focus Area Article Announcement (Tue Feb 25 2003 - 19:14:22 EST)
  • Dead thread -- Distributed spam-based DoS in progress (Wed Feb 19 2003 - 22:46:18 EST)
  • Incidents list administrivia and introductions... (Sat Feb 15 2003 - 19:13:42 EST)
• Dan Harpold
  • RE: Web server crashed, now is trying to contact an IP by port 80 every morning. (Mon Feb 24 2003 - 20:19:38 EST)
  • Web server crashed, now is trying to contact an IP by port 80 every morning. (Sun Feb 23 2003 - 22:20:01 EST)
• Dan Perez
  • RE: S4T4N1C Web Defacement (Thu Feb 13 2003 - 15:40:06 EST)
• Dave Aitel
  • Re: Scans on TCP port 135 (Fri Feb 21 2003 - 17:00:59 EST)
• Dave Hart
  • RE: Distributed spam-based DoS in progress (Wed Feb 19 2003 - 02:26:37 EST)
  • RE: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 14:28:30 EST)
• Dave Laird
  • Re: email address probes (Thu Feb 06 2003 - 02:57:41 EST)
• davec(at)skooter.net
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 12:13:00 EST)
• David Hodges
  • Re: ftp server compromised (Wed Feb 12 2003 - 22:33:18 EST)
• Denis Dimick
  • RE: ftp server compromised (Thu Feb 13 2003 - 00:45:35 EST)
• Eric Greenberg
  • Correction: www.ethereal.com not www.ethereal.org RE: Suspicious file on Desktop (Mon Feb 10 2003 - 16:34:09 EST)
  • RE: Suspicious file on Desktop (Mon Feb 10 2003 - 11:54:58 EST)
• Fitzgerald, John
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) (Wed Feb 05 2003 - 04:44:38 EST)
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) (Wed Feb 05 2003 - 04:51:14 EST)
• Frederic Harster
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Mon Feb 03 2003 - 10:56:23 EST)
• Geert Kiers
  • ALEVRIUS! (Thu Feb 06 2003 - 13:39:28 EST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Sun Feb 02 2003 - 12:45:32 EST)
• Gene Yoo
  • Re: Weird Profile in Documents and Settings (Thu Feb 20 2003 - 22:34:40 EST)
• Gordon Ewasiuk
  • Questions: LKM, yoyo & rootkits (Fri Feb 21 2003 - 08:31:43 EST)
• Greg A. Woods
  • Re: email address probes (Wed Feb 05 2003 - 18:04:44 EST)
• Greg Wiedeman
  • Weird Profile in Documents and Settings (Thu Feb 20 2003 - 06:38:16 EST)
• Guy Reisenauer
  • Re: Packets from 255.255.255.255(80) (Sun Feb 02 2003 - 15:27:04 EST)
• H C
  • Re: Weird Windows logon attempts (Mon Feb 24 2003 - 06:38:10 EST)
  • Re: UDP traffic on Port 52798 (Thu Feb 13 2003 - 13:32:33 EST)
  • Re: Netbios Name Scans/opaserv worm (Thu Feb 06 2003 - 17:02:50 EST)
  • Re: DoS Attacks, Detecting the Source, and Service Providers (Tue Feb 04 2003 - 15:44:06 EST)
• H D Moore
  • Re: /sumthin Revisited (Sat Feb 01 2003 - 15:59:50 EST)
• Hamid
  • DoS Attacks, Detecting the Source, and Service Providers (Mon Feb 03 2003 - 16:39:32 EST)
• Harry Hoffman
  • Weird Windows logon attempts (Sun Feb 23 2003 - 19:27:54 EST)
• HggdH
  • Re: S4T4N1C Web Defacement (Thu Feb 13 2003 - 14:43:11 EST)
• Holstein, Michael
  • Remote Access Software (Wireless Devices) (Tue Feb 25 2003 - 13:00:00 EST)
• Hoof Hearted
  • FTP/Port 1038 (Tue Feb 04 2003 - 13:49:55 EST)
• http-equiv(at)excite.com
  • Interesting (Wed Feb 26 2003 - 15:01:34 EST)
• Hugo van der Kooij
  • RE: Distributed spam-based DoS in progress (Wed Feb 19 2003 - 01:49:55 EST)
  • Re: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 01:48:20 EST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Sun Feb 02 2003 - 12:33:12 EST)
• Jacco Tunnissen
  • Re: Weird Windows logon attempts (Sun Feb 23 2003 - 22:08:42 EST)
• james
  • Re: email address probes (Thu Feb 06 2003 - 12:49:09 EST)
  • Re: DoS Attacks, Detecting the Source, and Service Providers (Tue Feb 04 2003 - 13:35:53 EST)
• James C Slora Jr
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 16:35:52 EST)
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 15:42:53 EST)
  • RE: ALEVRIUS! (Thu Feb 06 2003 - 18:43:51 EST)
• James Kelly
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Tue Feb 04 2003 - 13:26:56 EST)
• Jasmine
  • Re: Kuang2 strikes again, is it just me? (Sun Feb 16 2003 - 09:00:48 EST)
• Jason Dixon
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 11:57:24 EST)
  • Increased Kuang2 activity (Sun Feb 09 2003 - 19:01:23 EST)
• Jeff
  • Re: Kuang2 strikes again, is it just me? (Sun Feb 16 2003 - 12:39:10 EST)
• Jeff Kell
  • Kuang2 strikes again, is it just me? (Sat Feb 15 2003 - 20:35:02 EST)
  • Kuang2 on the rise... (Sun Feb 09 2003 - 01:23:00 EST)
• Jennifer Fountain
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 12:00:18 EST)
• jet
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Wed Feb 12 2003 - 02:19:54 EST)
• Joe Stewart
  • Re: Speedera Ping, was "Packets from 255.255.255.255(80), etc." (Tue Feb 04 2003 - 13:59:57 EST)
• Joel Tyson
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Mon Feb 03 2003 - 10:40:02 EST)
• Johann Kruse
  • RE: email address probes (Wed Feb 05 2003 - 19:08:44 EST)
• Johannes Ullrich
  • Re: Kuang2 strikes again, is it just me? (Sat Feb 15 2003 - 23:18:13 EST)
  • Re: Increased Kuang2 activity (Mon Feb 10 2003 - 11:55:45 EST)
• John Sage
  • Re: port 17300 probe fingerprint analysis (Tue Feb 18 2003 - 10:06:36 EST)
• Jon Rublack
  • Re: www.nopop.net (Mon Feb 17 2003 - 20:00:51 EST)
• Jonathan A. Zdziarski
  • RE: More /sumthin (Wed Feb 26 2003 - 16:14:37 EST)
• Jordan K Wiens
  • Re: Identity theft scam against eBay users (Mon Feb 10 2003 - 19:17:22 EST)
• Jyri Hovila
  • Re[2]: Weird Profile in Documents and Settings (Fri Feb 21 2003 - 13:10:58 EST)
• Kee Hinckley
  • Re: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 18:05:57 EST)
  • Re: email address probes (Wed Feb 05 2003 - 21:01:26 EST)
• Kenneth Wilson
  • UDP traffic on Port 52798 (Thu Feb 13 2003 - 09:01:58 EST)
• Kevin Patz
  • Scans on TCP port 135 (Thu Feb 20 2003 - 16:12:04 EST)
  • Re: Kuang2 strikes again, is it just me? (Tue Feb 18 2003 - 13:59:17 EST)
• Klayton Monroe
  • FTimes 3.2.0 Released (Fri Feb 21 2003 - 05:03:47 EST)
  • WebJob 1.2.3 Released (Fri Feb 21 2003 - 04:42:00 EST)
• Kurt Seifried
  • Re: Increased Kuang2 activity (Mon Feb 10 2003 - 20:04:12 EST)
• kyle(at)kylelai.com
  • mIRC Trojan Variant - port 445 worm/Trojan (Sun Feb 16 2003 - 17:49:50 EST)
• Leonard.Ong(at)nokia.com
  • RE: Possible new backdoor: mspx-smss.exe ? (Thu Feb 27 2003 - 15:24:39 EST)
• Levinson, Karl
  • RE: Web server crashed, now is trying to contact an IP by port 80 every morning. (Tue Feb 25 2003 - 08:21:25 EST)
• Logan F.D. Greenlee
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 13:37:29 EST)
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 11:46:16 EST)
• lsi
  • Re: Web server crashed, now is trying to contact an IP by port 80 every morning. (Mon Feb 24 2003 - 19:30:29 EST)
• Lucas Zaichkowsky
  • RE: Weird Profile in Documents and Settings (Thu Feb 20 2003 - 18:08:40 EST)
• Mark E. Donaldson
  • RE: ftp server compromised (Wed Feb 12 2003 - 21:31:48 EST)
  • RE: Traffic on UDP 1815 (Tue Feb 11 2003 - 23:50:56 EST)
• Mary McAllister
  • RE: Weird Windows logon attempts (Wed Feb 26 2003 - 17:09:25 EST)
• Matthew Breitenstine
  • Re: Identity theft scam against eBay users (Mon Feb 10 2003 - 19:17:48 EST)
• Meritt James
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Wed Feb 05 2003 - 09:35:44 EST)
• Michael LaSalvia
  • RE: Suspicious file on Desktop (Mon Feb 10 2003 - 11:58:56 EST)
• Michel Angelo da Silva Pereira
  • Re: S4T4N1C Web Defacement (Thu Feb 13 2003 - 17:58:20 EST)
  • Re: S4T4N1C Web Defacement (Thu Feb 13 2003 - 13:35:34 EST)
• Mr.Day
  • Spies on Your PC HDrv (Fri Feb 14 2003 - 01:33:19 EST)
• Ned Fleming
  • Re: email address probes (Thu Feb 06 2003 - 10:07:05 EST)
• Neil Dickey
  • ICMP Destination Unreachable, Administratively Prohibited (Thu Feb 13 2003 - 17:35:11 EST)
  • Speedera Ping, was "Packets from 255.255.255.255(80), etc." (Mon Feb 03 2003 - 11:53:03 EST)
• NESTING, DAVID M (SBCSI)
  • RE: Weird apache logs (Wed Feb 26 2003 - 14:15:59 EST)
• NetSec Analyst
  • RE: ALEVRIUS! (Fri Feb 07 2003 - 18:36:39 EST)
• Nick FitzGerald
  • Re: Identity theft scam against eBay users (Mon Feb 10 2003 - 23:46:39 EST)
• Pascal Bouchareine
  • www.nopop.net (Mon Feb 17 2003 - 10:42:11 EST)
• Patrick Bryant
  • Re: Identity theft scam against eBay users (Tue Feb 11 2003 - 13:56:24 EST)
  • Re: Identity theft scam against eBay users (Mon Feb 10 2003 - 20:29:43 EST)
  • Identity theft scam against eBay users (Mon Feb 10 2003 - 17:50:37 EST)
• Patrick Fish
  • Suspicious file on Desktop (Mon Feb 10 2003 - 05:12:14 EST)
• Patrick R. Sweeney
  • Re: Weird Profile in Documents and Settings (Fri Feb 21 2003 - 18:36:12 EST)
• Paul Dokas
  • Re: Kuang2 strikes again, is it just me? (Mon Feb 17 2003 - 12:57:34 EST)
• PAUL_TAYLOR(at)qvc.com
  • Re: Suspicious file on Desktop (Mon Feb 10 2003 - 12:11:54 EST)
• perrieror(at)ssginfo.montclair.edu
  • RE: FTP/Port 1038 (Thu Feb 13 2003 - 15:18:24 EST)
• Philipp Hug
  • Re: More /sumthin (Wed Feb 26 2003 - 09:23:17 EST)
• psion
  • Re: ftp server compromised (Thu Feb 13 2003 - 01:52:56 EST)
• Rafael Coninck Teigao
  • Re: Interesting (Fri Feb 28 2003 - 12:38:35 EST)
  • Re: ICQ problem. (Mon Feb 24 2003 - 15:51:28 EST)
• rbelchez(at)show-net.net
  • ftp server compromised (Wed Feb 12 2003 - 20:20:47 EST)
• Rev. Kronovohr
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 12:01:03 EST)
• Ricardo Castanho de Oliveira Freitas
  • Re: Web Defacement (Fri Feb 14 2003 - 07:50:16 EST)
• Richard Rager
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Tue Feb 11 2003 - 13:46:29 EST)
• Rob Shein
  • RE: Weird Profile in Documents and Settings (Thu Feb 20 2003 - 11:18:38 EST)
  • RE: Kuang2 strikes again, is it just me? (Sat Feb 15 2003 - 23:02:48 EST)
  • RE: email address probes (Thu Feb 06 2003 - 19:54:52 EST)
  • RE: ALEVRIUS! (Thu Feb 06 2003 - 18:31:32 EST)
  • RE: DoS Attacks, Detecting the Source, and Service Providers (Tue Feb 04 2003 - 13:56:13 EST)
• rocky_scotti(at)na.dole.com
  • Netbios Name Scans/opaserv worm (Thu Feb 06 2003 - 12:49:07 EST)
• Rohan Amin
  • Re: Distributed spam-based DoS in progress (Thu Feb 20 2003 - 00:04:43 EST)
• root(at)darks
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Tue Feb 11 2003 - 20:46:48 EST)
• Royans Tharakan
  • port 17300 probe fingerprint analysis (Mon Feb 17 2003 - 23:00:31 EST)
• Russell Fulton
  • Re: Weird Windows logon attempts (Tue Feb 25 2003 - 18:14:56 EST)
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Thu Feb 13 2003 - 18:38:32 EST)
• Sahr, Kenneth
  • RE: Traffic on UDP 1815 (Wed Feb 12 2003 - 08:14:27 EST)
  • Traffic on UDP 1815 (Tue Feb 11 2003 - 10:21:12 EST)
• Salisko, Rick
  • RE: ALEVRIUS! (Fri Feb 07 2003 - 14:29:24 EST)
• Salomao Barguil
  • Backdoor ?? "Girlnextdoor_" TCP Ports 1025/1028 (Thu Feb 27 2003 - 19:40:23 EST)
• Scott Harris
  • Re: ano@ano.com ftpd dip.t-dialin.net (Sun Feb 16 2003 - 14:51:40 EST)
• Security
  • Possible stateful filtering problem? (Fri Feb 21 2003 - 05:29:16 EST)
• security(at)imperialdesigns.com
  • Re: S4T4N1C Web Defacement (Fri Feb 14 2003 - 08:36:39 EST)
• Stephen J. Friedl
  • Re: Interesting (Thu Feb 27 2003 - 11:13:02 EST)
• Steve Drees
  • RE: Distributed spam-based DoS in progress (Wed Feb 19 2003 - 14:43:55 EST)
• Sven Pechler
  • Re: Possible new backdoor: mspx-smss.exe ? (Wed Feb 26 2003 - 16:19:15 EST)
  • Possible new backdoor: mspx-smss.exe ? (Fri Feb 21 2003 - 06:57:16 EST)
• Sverre H. Huseby
  • More /sumthin, maybe (Mon Feb 03 2003 - 03:52:54 EST)
• Terence Runge
  • RE: Weird Windows logon attempts (Mon Feb 24 2003 - 02:00:50 EST)
• Thiago Madeira de Lima
  • ICQ problem. (Fri Feb 21 2003 - 12:26:59 EST)
• Thierry Zoller
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 19:26:02 EST)
• Thomas Giudice
  • Re: Identity theft scam against eBay users (Tue Feb 11 2003 - 06:32:48 EST)
• Tibor Biro
  • Re: ftp server compromised (Wed Feb 12 2003 - 21:10:11 EST)
• Tim Heagarty
  • RE: Kuang2 strikes again, is it just me? (Mon Feb 17 2003 - 00:16:39 EST)
• Tom Arseneault
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) (Mon Feb 03 2003 - 14:22:36 EST)
• Transistor Sister
  • Re: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 21:35:33 EST)
  • Distributed spam-based DoS in progress (Mon Feb 17 2003 - 20:25:19 EST)
• Travis Read
  • Weird apache logs (Tue Feb 25 2003 - 20:57:20 EST)
• Trevor Metzger
  • RE: Kuang2 strikes again, is it just me? (Sun Feb 16 2003 - 18:28:36 EST)
• Valdis.Kletnieks(at)vt.edu
  • Re: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 14:48:38 EST)
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Fri Feb 14 2003 - 11:11:35 EST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Mon Feb 03 2003 - 14:04:52 EST)
• william.miller(at)gsa.gov
  • Re: port 17300 probe fingerprint analysis (Wed Feb 19 2003 - 07:30:17 EST)
• zmajd fully
  • Re: Packet from port 80 with spoofed microsoft.com ip (Mon Feb 03 2003 - 18:27:59 EST)

  This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:18 EDT