Mailing List Archive For incidents@securityfocus.com Apr 2003 By Author

• aladin168
  • Re: IP Spoofs in the log - not sure what to do next (Thu Apr 24 2003 - 10:12:04 EDT)
  • Re: Trojan found... (Thu Apr 24 2003 - 10:22:50 EDT)
  • Re: Increase in Source to Port 445 (Thu Apr 03 2003 - 14:45:07 EST)
• Alan B. Clegg
  • UDP packets towards port 38293 (NAV) (Tue Apr 29 2003 - 20:51:54 EDT)
• Alex Lambert
  • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? (Thu Apr 10 2003 - 20:55:08 EDT)
• Alfred Huger
  • Educational Incident Data Comparison Pilot (X-Post) (Tue Apr 01 2003 - 18:50:44 EST)
• Amarante, Rodrigo P.
  • RE: Logon.dll? Possible root-kit? (Thu Apr 03 2003 - 10:13:59 EST)
• Benjamin Tomhave
  • RECAP: possible rootkit, maybe partial? (Thu Apr 03 2003 - 16:45:17 EST)
  • possible rootkit, maybe partial? (Wed Apr 02 2003 - 22:47:05 EST)
• Bojan Zdrnja
  • Re: SMTP probes (Sat Apr 05 2003 - 05:23:22 EST)
• Brad Doctor
  • Re: lots of port 0 scannings (Mon Apr 28 2003 - 13:19:09 EDT)
• Brett Glass
  • Re: Company being War Dialed (Sun Apr 20 2003 - 00:45:26 EDT)
• Chris Boyd
  • Re: SMTP Scans (Mon Apr 28 2003 - 13:25:15 EDT)
• Chris Cahill
  • undetected DDOS (Mon Apr 28 2003 - 15:30:55 EDT)
• Chris Corbett
  • IP Spoofs in the log - not sure what to do next (Thu Apr 17 2003 - 18:17:53 EDT)
• Chris Mann
  • Re: Logs showing GET /.hash=... (Wed Apr 30 2003 - 13:30:31 EDT)
• Christine Kronberg
  • Re: SMTP probes (Mon Apr 07 2003 - 05:28:04 EDT)
• crawford charles
  • Re: FW: IP Spoofs in the log - not sure what to do next (Mon Apr 21 2003 - 13:30:52 EDT)
• crucible
  • Re: SQL Slammer Variant? (Tue Apr 01 2003 - 07:53:20 EST)
• Curt Purdy
  • RE: Company being War Dialed (Sun Apr 20 2003 - 10:41:57 EDT)
  • RE: IP Spoofs in the log - not sure what to do next (Sun Apr 20 2003 - 11:06:45 EDT)
• D.C. van Moolenbroek
  • Re: possible rootkit, maybe partial? (Thu Apr 03 2003 - 07:59:03 EST)
• Dan Hanson
  • Administrivia: SPAM control, vacation messages, and the like. (Wed Apr 30 2003 - 12:09:24 EDT)
  • New SecurityFocus article: Steganography Revealed (Wed Apr 09 2003 - 12:38:50 EDT)
  • New SecurityFocus article: Specter: A Commercial Honeypot Solution for Windows (Wed Apr 09 2003 - 12:37:17 EDT)
  • New Article: U.S. Information Security Law, Part 2 (Tue Apr 01 2003 - 13:25:24 EST)
• David Hawley
  • Re: FW: IP Spoofs in the log - not sure what to do next (Tue Apr 22 2003 - 04:13:52 EDT)
• David Klotz
  • RE: IP Spoofs in the log - not sure what to do next (Mon Apr 21 2003 - 09:27:40 EDT)
• dean(at)packethunter.com
  • Re: Does anyone recognize the scanner that causes this pattern ? (Mon Apr 07 2003 - 16:00:36 EDT)
  • Does anyone recognize the scanner that causes this pattern ? (Sun Apr 06 2003 - 15:24:23 EDT)
• defaillance(at)hushmail.com
  • Port 3366 activity (Tue Apr 15 2003 - 11:35:28 EDT)
• Dowling, Gabrielle
  • RE: Strange, scary, subtle trojan (Sun Apr 20 2003 - 14:35:35 EDT)
• dreamwvr(at)dreamwvr.com
  • Re: POP3 logon attempts (Tue Apr 01 2003 - 10:33:56 EST)
• ePAc
  • Re: [CERT] possible rootkit, maybe partial? (Wed Apr 02 2003 - 23:27:17 EST)
• falcon(at)cybersecret.com
  • Field Report: New Worm (Thu Apr 03 2003 - 08:01:22 EST)
• Faron.Golden(at)Gunter.AF.mil
  • Anyone seen this UDP source port 7001 traffic? (Thu Apr 17 2003 - 17:53:07 EDT)
• Frank Knobbe
  • Re: New CodeRed strain? -- UPDATE (Mon Apr 28 2003 - 13:13:11 EDT)
  • Re: New CodeRed strain? (Fri Apr 25 2003 - 15:23:57 EDT)
  • New CodeRed strain? (Fri Apr 25 2003 - 14:55:13 EDT)
• Fred Kreitzberg
  • Company being War Dialed (Thu Apr 17 2003 - 19:13:03 EDT)
• Gene
  • Re: Does anyone recognize the scanner that causes this pattern ? (Sun Apr 06 2003 - 19:00:55 EDT)
• George Bakos
  • Re: Tracking proxies on port 1180/1182 (Mon Apr 21 2003 - 15:55:45 EDT)
• Gerd Feiner
  • Re: Port 17300 probes? (Mon Apr 14 2003 - 12:37:54 EDT)
• Hahn, Jacob
  • Odd IIS log entries (Mon Apr 28 2003 - 13:27:11 EDT)
• Harlan Carvey
  • re: port 5168 (Fri Apr 18 2003 - 06:54:04 EDT)
  • Re: Trojan found... (Thu Apr 17 2003 - 19:08:36 EDT)
  • Re: Logon.dll? Possible root-kit? (Thu Apr 03 2003 - 20:14:08 EST)
  • Re: Logon.dll? Possible root-kit? (Thu Apr 03 2003 - 08:20:10 EST)
• Hoof Hearted
  • Re: SMTP Scans (Fri Apr 25 2003 - 20:21:57 EDT)
  • Re: SMTP Scans (Sun Apr 20 2003 - 07:07:04 EDT)
• incidents(at)mwwm.net
  • Port 17300 probes? (Mon Apr 14 2003 - 02:50:45 EDT)
• jac
  • Re: New attack or old Vulnerability Scanner? (Tue Apr 29 2003 - 16:21:49 EDT)
• James C Slora Jr
  • RE: Increase in Source to Port 445 (Thu Apr 03 2003 - 10:07:01 EST)
• James C. Slora, Jr.
  • RE: Odd IIS log entries (Wed Apr 30 2003 - 09:28:08 EDT)
  • RE: New attack or old Vulnerability Scanner? (Fri Apr 25 2003 - 15:00:56 EDT)
• James.Jackson(at)broadwing.com
  • RE: Company being War Dialed (Mon Apr 21 2003 - 15:07:02 EDT)
• James.Phillips(at)mutualofomaha.com
  • Re: Company being War Dialed (Mon Apr 21 2003 - 13:15:40 EDT)
• Jason Falciola
  • Re: New attack or old Vulnerability Scanner? (Wed Apr 30 2003 - 13:41:05 EDT)
  • Re: New attack or old Vulnerability Scanner? (Tue Apr 29 2003 - 20:37:19 EDT)
  • Re: New attack or old Vulnerability Scanner? (Sat Apr 26 2003 - 07:56:17 EDT)
• Jason Pagano
  • RE: Logon.dll? Possible root-kit? (Fri Apr 04 2003 - 08:40:32 EST)
• Jeff Kell
  • Strange, scary, subtle trojan (Fri Apr 18 2003 - 01:01:15 EDT)
• Jeff Lane
  • Increase of attempts on port 635 in last couple days (Wed Apr 02 2003 - 10:45:14 EST)
• Jeremy Junginger
  • RE: WebDAV Exploit Lab (Tue Apr 01 2003 - 10:28:01 EST)
• Jerome
  • unknown rootkit found in the wild (Mon Apr 07 2003 - 14:40:07 EDT)
• Jerry Shenk
  • RE: Does anyone recognize the scanner that causes this pattern ? (Mon Apr 07 2003 - 11:34:02 EDT)
• Jimi Thompson
  • RE: SMTP Scans (Wed Apr 23 2003 - 23:15:57 EDT)
• Joe Stewart
  • Tracking proxies on port 1180/1182 (Mon Apr 21 2003 - 14:54:48 EDT)
  • Re: Port 17300 probes? (Tue Apr 15 2003 - 17:18:38 EDT)
  • ATD OpenSSL Mass Exploiter Analysis (another "/sumthin" scan tool) (Mon Apr 07 2003 - 17:54:54 EDT)
• John Ives
  • RE: Logon/Logoff Failure Events (Thu Apr 03 2003 - 13:04:15 EST)
• Joris De Donder
  • Re: Port 17300 probes? (Tue Apr 15 2003 - 14:38:55 EDT)
• Jose Nazario
  • Re: Anyone seen this UDP source port 7001 traffic? (Mon Apr 28 2003 - 13:12:44 EDT)
  • Re: protocol watcher (Wed Apr 23 2003 - 10:22:29 EDT)
• Joshua Wright
  • RE: UDP traffic to net and broadcast addresses (Thu Apr 03 2003 - 14:53:11 EST)
• Justin Coffi
  • RE: Does anyone recognize the scanner that causes this pattern ? (Mon Apr 07 2003 - 04:50:58 EDT)
• Justin Pryzby
  • Re: New CodeRed strain? -- UPDATE (Tue Apr 29 2003 - 18:13:53 EDT)
  • protocol watcher (Tue Apr 22 2003 - 11:03:06 EDT)
• kbergen(at)bellsouth.net
  • Logging of connects to port 6346 (Mon Apr 14 2003 - 18:58:03 EDT)
• Keith
  • RE: New attack or old Vulnerability Scanner? (Fri Apr 25 2003 - 17:40:40 EDT)
• Keith Bergen
  • Logs showing GET /.hash=... (Wed Apr 30 2003 - 09:54:30 EDT)
• Kevin Hodle
  • RE: port 139 syn-fin scans (Mon Apr 21 2003 - 01:51:33 EDT)
• Kevin Patz
  • Scans on TCP port 9631 + other unknown ports (Fri Apr 25 2003 - 08:10:30 EDT)
  • Re: Port 17300 probes? (Mon Apr 14 2003 - 15:12:02 EDT)
• Kevin Reardon
  • Re: Intresting problem concerning libresolv.so.2 (Thu Apr 17 2003 - 20:05:22 EDT)
• Kurt Seifried
  • Re: SMTP Scans (Thu Apr 24 2003 - 15:43:20 EDT)
  • Re: Company being War Dialed (Sun Apr 20 2003 - 03:02:44 EDT)
• larosa, vjay
  • RE: New CodeRed strain? -- UPDATE (Tue Apr 29 2003 - 22:38:03 EDT)
• Laurent Luyckx
  • Re: Does anyone recognize the scanner that causes this pattern ? (Mon Apr 07 2003 - 02:58:58 EDT)
• Leo, Joel
  • RE: Why alerts on ports 1025-1029, 1036 (Tue Apr 01 2003 - 19:54:23 EST)
• Les Ault
  • Re: Trojan found... (Thu Apr 17 2003 - 21:47:49 EDT)
  • Trojan found... (Tue Apr 15 2003 - 20:24:49 EDT)
• LordInfidel
  • RE: Logging of connects to port 6346 (Tue Apr 15 2003 - 17:30:38 EDT)
• Luc Somers
  • RE: SMTP Scans (Tue Apr 22 2003 - 11:42:36 EDT)
• Mally Mclane
  • RE: SMTP Scans (Tue Apr 22 2003 - 10:40:28 EDT)
• Mark Embrich
  • Re: New attack or old Vulnerability Scanner? (Tue Apr 29 2003 - 14:34:03 EDT)
  • New attack or old Vulnerability Scanner? (Thu Apr 24 2003 - 19:43:43 EDT)
• MARLON BORBA
  • Re: Port 17300 probes? (Mon Apr 14 2003 - 12:38:56 EDT)
• Michael Lau
  • Re: Anyone seen this UDP source port 7001 traffic? (Sat Apr 26 2003 - 20:34:29 EDT)
• Michael Scheidell
  • Re: Tracking proxies on port 1180/1182 (Mon Apr 21 2003 - 15:56:46 EDT)
• Mike
  • Re: POP3 logon attempts (Tue Apr 01 2003 - 22:40:07 EST)
• Mike Mills
  • UDP scans from AOL NS boxes? (Thu Apr 03 2003 - 12:27:07 EST)
• Mike Parkin
  • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? (Tue Apr 15 2003 - 11:37:48 EDT)
  • New trojan? Old trojan with new characteristics? Anyone seen this? (Wed Apr 09 2003 - 18:51:11 EDT)
• Molony, Duncan
  • port 5168 (Thu Apr 17 2003 - 14:03:42 EDT)
• Muchacki Robert
  • Re: port 139 syn-fin scans (Sun Apr 20 2003 - 16:02:52 EDT)
• Neil Dickey
  • Re: lots of port 0 scannings (Mon Apr 28 2003 - 15:28:36 EDT)
  • Re: SMTP probes (Sat Apr 05 2003 - 00:09:04 EST)
• Nexus
  • Re: UDP packets towards port 38293 (NAV) (Wed Apr 30 2003 - 17:37:36 EDT)
• Nick Jacobsen
  • Re: Logon.dll? Possible root-kit? (Thu Apr 03 2003 - 20:23:24 EST)
  • Re: Logon.dll? Possible root-kit? (Thu Apr 03 2003 - 15:43:05 EST)
  • Re: Logon.dll? Possible root-kit? (Wed Apr 02 2003 - 23:29:21 EST)
  • Logon.dll? Possible root-kit? (Wed Apr 02 2003 - 21:09:47 EST)
• Nicolas Couture
  • Re: Logging of connects to port 6346 (Tue Apr 15 2003 - 13:16:38 EDT)
• Nikola Pepelishev
  • Re: msamba (Tue Apr 22 2003 - 04:12:00 EDT)
• nobody
  • Re: [0.5OT answer]possible rootkit, maybe partial? (Thu Apr 03 2003 - 07:55:14 EST)
• noconflic
  • Re: msamba (Tue Apr 22 2003 - 11:14:48 EDT)
  • Re: msamba (Tue Apr 22 2003 - 10:48:34 EDT)
• nospam(at)none.net
  • RE: Company being War Dialed (Tue Apr 22 2003 - 12:33:23 EDT)
• Patrick Nolan
  • Re: Trojan found... (Thu Apr 24 2003 - 16:58:18 EDT)
• Paul Gear
  • Re: Intresting problem concerning libresolv.so.2 (Sun Apr 20 2003 - 02:00:29 EDT)
  • Re: Intresting problem concerning libresolv.so.2 (Fri Apr 18 2003 - 23:53:21 EDT)
• paul(at)doevil.com
  • RE: SMTP Scans (Sat Apr 26 2003 - 03:09:35 EDT)
• Paulo Abrantes
  • Re: msamba (Mon Apr 21 2003 - 14:00:54 EDT)
• public list
  • Re: Company being War Dialed (Mon Apr 21 2003 - 02:06:03 EDT)
• rhandwerker(at)iss.net
  • Re: New attack or old Vulnerability Scanner? (Mon Apr 28 2003 - 12:45:20 EDT)
• Rich Puhek
  • SMTP probes (Fri Apr 04 2003 - 14:22:23 EST)
• Richard Rager
  • Re: possible rootkit, maybe partial? (Wed Apr 02 2003 - 23:29:03 EST)
• Rob Keown
  • Increase in Source to Port 445 (Tue Apr 01 2003 - 21:54:58 EST)
• Rob Shein
  • RE: SMTP Scans (Mon Apr 21 2003 - 18:50:33 EDT)
  • RE: Logon.dll? Possible root-kit? (Fri Apr 04 2003 - 12:02:03 EST)
  • RE: Logon.dll? Possible root-kit? (Thu Apr 03 2003 - 10:34:45 EST)
  • RE: SQL Slammer Variant? (Wed Apr 02 2003 - 10:24:13 EST)
• Robert Wagner
  • RE: Logon/Logoff Failure Events (Tue Apr 01 2003 - 10:16:28 EST)
• Russell Fulton
  • Re: UDP packets towards port 38293 (NAV) (Wed Apr 30 2003 - 15:54:29 EDT)
• Russell Morrison
  • RE: Logon/Logoff Failure Events (Thu Apr 03 2003 - 11:17:50 EST)
• Sam Evans
  • Intresting problem concerning libresolv.so.2 (Tue Apr 15 2003 - 15:00:19 EDT)
• SB CH
  • lots of port 0 scannings (Sun Apr 27 2003 - 20:51:58 EDT)
• Scott A. McIntyre
  • Re: port 139 syn-fin scans (Sun Apr 20 2003 - 05:11:21 EDT)
• sf(at)noameppel.com
  • Mo'Logs (Sat Apr 19 2003 - 22:50:04 EDT)
• Skip Carter
  • port 139 syn-fin scans (Fri Apr 18 2003 - 14:51:32 EDT)
• Steve Bromwich
  • Re: msamba (Tue Apr 22 2003 - 10:08:18 EDT)
  • msamba (Mon Apr 21 2003 - 11:41:27 EDT)
• Steve Cody
  • Re: POP3 logon attempts (Tue Apr 22 2003 - 17:44:06 EDT)
• Stuart Wallace
  • RE: Why alerts on ports 1025-1029, 1036 (Tue Apr 01 2003 - 03:14:12 EST)
• Taz
  • RE: Anyone seen this UDP source port 7001 traffic? (Mon Apr 28 2003 - 13:14:53 EDT)
• Thomas Vincent
  • Port 6666 Scans (Wed Apr 16 2003 - 09:51:26 EDT)
• Tina Bird
  • Re: Anyone seen this UDP source port 7001 traffic? (Mon Apr 28 2003 - 15:30:52 EDT)
• Tobias Klein
  • Re: msamba (Fri Apr 25 2003 - 06:06:02 EDT)
• Toby Miller
  • RE: port 139 syn-fin scans (Sun Apr 20 2003 - 21:08:45 EDT)
• Tom Fischer
  • Re: POP3 logon attempts (Tue Apr 01 2003 - 03:49:34 EST)
• vex86(at)rogers.com
  • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? (Mon Apr 14 2003 - 19:57:00 EDT)
• William Salusky
  • Re: msamba (Tue Apr 22 2003 - 01:20:00 EDT)
• Wilson, Aaron J.
  • RE: SQL Slammer Variant? (Tue Apr 01 2003 - 16:17:06 EST)
• Zen
  • UDP traffic to net and broadcast addresses (Wed Apr 02 2003 - 05:12:14 EST)

  This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:18 EDT