Mailing List Archive For incidents@securityfocus.com Apr 2003 By Date

• Wed Apr 30 2003 - 17:37:36 EDT
  • Re: UDP packets towards port 38293 (NAV) Nexus 
• Wed Apr 30 2003 - 15:54:29 EDT
  • Re: UDP packets towards port 38293 (NAV) Russell Fulton 
• Wed Apr 30 2003 - 13:30:31 EDT
  • Re: Logs showing GET /.hash=... Chris Mann 
• Wed Apr 30 2003 - 13:41:05 EDT
  • Re: New attack or old Vulnerability Scanner? Jason Falciola 
• Tue Apr 29 2003 - 20:37:19 EDT
  • Re: New attack or old Vulnerability Scanner? Jason Falciola 
• Tue Apr 29 2003 - 20:51:54 EDT
  • UDP packets towards port 38293 (NAV) Alan B. Clegg 
• Wed Apr 30 2003 - 09:54:30 EDT
  • Logs showing GET /.hash=... Keith Bergen 
• Wed Apr 30 2003 - 09:28:08 EDT
  • RE: Odd IIS log entries James C. Slora, Jr. 
• Tue Apr 29 2003 - 22:38:03 EDT
  • RE: New CodeRed strain? -- UPDATE larosa, vjay 
• Wed Apr 30 2003 - 12:09:24 EDT
  • Administrivia: SPAM control, vacation messages, and the like. Dan Hanson 
• Tue Apr 29 2003 - 14:34:03 EDT
  • Re: New attack or old Vulnerability Scanner? Mark Embrich 
• Tue Apr 29 2003 - 18:13:53 EDT
  • Re: New CodeRed strain? -- UPDATE Justin Pryzby 
• Tue Apr 29 2003 - 16:21:49 EDT
  • Re: New attack or old Vulnerability Scanner? jac 
• Mon Apr 28 2003 - 13:12:44 EDT
  • Re: Anyone seen this UDP source port 7001 traffic? Jose Nazario 
• Mon Apr 28 2003 - 15:30:52 EDT
  • Re: Anyone seen this UDP source port 7001 traffic? Tina Bird 
• Mon Apr 28 2003 - 15:30:55 EDT
  • undetected DDOS Chris Cahill 
• Mon Apr 28 2003 - 15:28:36 EDT
  • Re: lots of port 0 scannings Neil Dickey 
• Mon Apr 28 2003 - 13:14:53 EDT
  • RE: Anyone seen this UDP source port 7001 traffic? Taz 
• Mon Apr 28 2003 - 13:19:09 EDT
  • Re: lots of port 0 scannings Brad Doctor 
• Mon Apr 28 2003 - 13:27:11 EDT
  • Odd IIS log entries Hahn, Jacob 
• Mon Apr 28 2003 - 13:25:15 EDT
  • Re: SMTP Scans Chris Boyd 
• Mon Apr 28 2003 - 13:13:11 EDT
  • Re: New CodeRed strain? -- UPDATE Frank Knobbe 
• Mon Apr 28 2003 - 12:45:20 EDT
  • Re: New attack or old Vulnerability Scanner? rhandwerker(at)iss.net 
• Fri Apr 25 2003 - 17:40:40 EDT
  • RE: New attack or old Vulnerability Scanner? Keith 
• Sun Apr 27 2003 - 20:51:58 EDT
  • lots of port 0 scannings SB CH 
• Fri Apr 25 2003 - 15:23:57 EDT
  • Re: New CodeRed strain? Frank Knobbe 
• Sat Apr 26 2003 - 20:34:29 EDT
  • Re: Anyone seen this UDP source port 7001 traffic? Michael Lau 
• Sat Apr 26 2003 - 07:56:17 EDT
  • Re: New attack or old Vulnerability Scanner? Jason Falciola 
• Fri Apr 25 2003 - 14:55:13 EDT
  • New CodeRed strain? Frank Knobbe 
• Sat Apr 26 2003 - 03:09:35 EDT
  • RE: SMTP Scans paul(at)doevil.com 
• Fri Apr 25 2003 - 20:21:57 EDT
  • Re: SMTP Scans Hoof Hearted 
• Fri Apr 25 2003 - 15:00:56 EDT
  • RE: New attack or old Vulnerability Scanner? James C. Slora, Jr. 
• Fri Apr 25 2003 - 08:10:30 EDT
  • Scans on TCP port 9631 + other unknown ports Kevin Patz 
• Fri Apr 25 2003 - 06:06:02 EDT
  • Re: msamba Tobias Klein 
• Thu Apr 24 2003 - 19:43:43 EDT
  • New attack or old Vulnerability Scanner? Mark Embrich 
• Thu Apr 24 2003 - 16:58:18 EDT
  • Re: Trojan found... Patrick Nolan 
• Thu Apr 24 2003 - 15:43:20 EDT
  • Re: SMTP Scans Kurt Seifried 
• Thu Apr 24 2003 - 10:12:04 EDT
  • Re: IP Spoofs in the log - not sure what to do next aladin168 
• Thu Apr 24 2003 - 10:22:50 EDT
  • Re: Trojan found... aladin168 
• Wed Apr 23 2003 - 23:15:57 EDT
  • RE: SMTP Scans Jimi Thompson 
• Wed Apr 23 2003 - 10:22:29 EDT
  • Re: protocol watcher Jose Nazario 
• Tue Apr 22 2003 - 17:44:06 EDT
  • Re: POP3 logon attempts Steve Cody 
• Tue Apr 22 2003 - 12:33:23 EDT
  • RE: Company being War Dialed nospam(at)none.net 
• Tue Apr 22 2003 - 11:03:06 EDT
  • protocol watcher Justin Pryzby 
• Tue Apr 22 2003 - 11:42:36 EDT
  • RE: SMTP Scans Luc Somers 
• Tue Apr 22 2003 - 11:14:48 EDT
  • Re: msamba noconflic 
• Tue Apr 22 2003 - 10:48:34 EDT
  • Re: msamba noconflic 
• Tue Apr 22 2003 - 10:40:28 EDT
  • RE: SMTP Scans Mally Mclane 
• Tue Apr 22 2003 - 10:08:18 EDT
  • Re: msamba Steve Bromwich 
• Tue Apr 22 2003 - 04:13:52 EDT
  • Re: FW: IP Spoofs in the log - not sure what to do next David Hawley 
• Tue Apr 22 2003 - 04:12:00 EDT
  • Re: msamba Nikola Pepelishev 
• Tue Apr 22 2003 - 01:20:00 EDT
  • Re: msamba William Salusky 
• Mon Apr 21 2003 - 18:50:33 EDT
  • RE: SMTP Scans Rob Shein 
• Mon Apr 21 2003 - 15:56:46 EDT
  • Re: Tracking proxies on port 1180/1182 Michael Scheidell 
• Mon Apr 21 2003 - 15:07:02 EDT
  • RE: Company being War Dialed James.Jackson(at)broadwing.com 
• Mon Apr 21 2003 - 15:55:45 EDT
  • Re: Tracking proxies on port 1180/1182 George Bakos 
• Mon Apr 21 2003 - 14:54:48 EDT
  • Tracking proxies on port 1180/1182 Joe Stewart 
• Mon Apr 21 2003 - 14:00:54 EDT
  • Re: msamba Paulo Abrantes 
• Sun Apr 20 2003 - 14:35:35 EDT
  • RE: Strange, scary, subtle trojan Dowling, Gabrielle 
• Mon Apr 21 2003 - 13:30:52 EDT
  • Re: FW: IP Spoofs in the log - not sure what to do next crawford charles 
• Mon Apr 21 2003 - 09:27:40 EDT
  • RE: IP Spoofs in the log - not sure what to do next David Klotz 
• Mon Apr 21 2003 - 02:06:03 EDT
  • Re: Company being War Dialed public list 
• Sun Apr 20 2003 - 21:08:45 EDT
  • RE: port 139 syn-fin scans Toby Miller 
• Mon Apr 21 2003 - 13:15:40 EDT
  • Re: Company being War Dialed James.Phillips(at)mutualofomaha.com 
• Mon Apr 21 2003 - 11:41:27 EDT
  • msamba Steve Bromwich 
• Sun Apr 20 2003 - 16:02:52 EDT
  • Re: port 139 syn-fin scans Muchacki Robert 
• Sun Apr 20 2003 - 10:41:57 EDT
  • RE: Company being War Dialed Curt Purdy 
• Sun Apr 20 2003 - 07:07:04 EDT
  • Re: SMTP Scans Hoof Hearted 
• Mon Apr 21 2003 - 01:51:33 EDT
  • RE: port 139 syn-fin scans Kevin Hodle 
• Sun Apr 20 2003 - 05:11:21 EDT
  • Re: port 139 syn-fin scans Scott A. McIntyre 
• Sun Apr 20 2003 - 11:06:45 EDT
  • RE: IP Spoofs in the log - not sure what to do next Curt Purdy 
• Sun Apr 20 2003 - 02:00:29 EDT
  • Re: Intresting problem concerning libresolv.so.2 Paul Gear 
• Sun Apr 20 2003 - 03:02:44 EDT
  • Re: Company being War Dialed Kurt Seifried 
• Sat Apr 19 2003 - 22:50:04 EDT
  • Mo'Logs sf(at)noameppel.com 
• Fri Apr 18 2003 - 23:53:21 EDT
  • Re: Intresting problem concerning libresolv.so.2 Paul Gear 
• Sun Apr 20 2003 - 00:45:26 EDT
  • Re: Company being War Dialed Brett Glass 
• Fri Apr 18 2003 - 06:54:04 EDT
  • re: port 5168 Harlan Carvey 
• Fri Apr 18 2003 - 14:51:32 EDT
  • port 139 syn-fin scans Skip Carter 
• Fri Apr 18 2003 - 01:01:15 EDT
  • Strange, scary, subtle trojan Jeff Kell 
• Thu Apr 17 2003 - 19:08:36 EDT
  • Re: Trojan found... Harlan Carvey 
• Thu Apr 17 2003 - 21:47:49 EDT
  • Re: Trojan found... Les Ault 
• Thu Apr 17 2003 - 19:13:03 EDT
  • Company being War Dialed Fred Kreitzberg 
• Thu Apr 17 2003 - 20:05:22 EDT
  • Re: Intresting problem concerning libresolv.so.2 Kevin Reardon 
• Thu Apr 17 2003 - 18:17:53 EDT
  • IP Spoofs in the log - not sure what to do next Chris Corbett 
• Thu Apr 17 2003 - 17:53:07 EDT
  • Anyone seen this UDP source port 7001 traffic? Faron.Golden(at)Gunter.AF.mil 
• Tue Apr 15 2003 - 15:00:19 EDT
  • Intresting problem concerning libresolv.so.2 Sam Evans 
• Wed Apr 16 2003 - 09:51:26 EDT
  • Port 6666 Scans Thomas Vincent 
• Tue Apr 15 2003 - 20:24:49 EDT
  • Trojan found... Les Ault 
• Tue Apr 15 2003 - 13:16:38 EDT
  • Re: Logging of connects to port 6346 Nicolas Couture 
• Thu Apr 17 2003 - 14:03:42 EDT
  • port 5168 Molony, Duncan 
• Tue Apr 15 2003 - 17:18:38 EDT
  • Re: Port 17300 probes? Joe Stewart 
• Tue Apr 15 2003 - 17:30:38 EDT
  • RE: Logging of connects to port 6346 LordInfidel 
• Tue Apr 15 2003 - 14:38:55 EDT
  • Re: Port 17300 probes? Joris De Donder 
• Tue Apr 15 2003 - 11:37:48 EDT
  • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? Mike Parkin 
• Mon Apr 14 2003 - 18:58:03 EDT
  • Logging of connects to port 6346 kbergen(at)bellsouth.net 
• Tue Apr 15 2003 - 11:35:28 EDT
  • Port 3366 activity defaillance(at)hushmail.com 
• Mon Apr 14 2003 - 19:57:00 EDT
  • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? vex86(at)rogers.com 
• Mon Apr 14 2003 - 12:38:56 EDT
  • Re: Port 17300 probes? MARLON BORBA 
• Mon Apr 14 2003 - 15:12:02 EDT
  • Re: Port 17300 probes? Kevin Patz 
• Mon Apr 14 2003 - 12:37:54 EDT
  • Re: Port 17300 probes? Gerd Feiner 
• Mon Apr 14 2003 - 02:50:45 EDT
  • Port 17300 probes? incidents(at)mwwm.net 
• Thu Apr 10 2003 - 20:55:08 EDT
  • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? Alex Lambert 
• Wed Apr 09 2003 - 18:51:11 EDT
  • New trojan? Old trojan with new characteristics? Anyone seen this? Mike Parkin 
• Wed Apr 09 2003 - 12:38:50 EDT
  • New SecurityFocus article: Steganography Revealed Dan Hanson 
• Wed Apr 09 2003 - 12:37:17 EDT
  • New SecurityFocus article: Specter: A Commercial Honeypot Solution for Windows Dan Hanson 
• Sun Apr 06 2003 - 19:00:55 EDT
  • Re: Does anyone recognize the scanner that causes this pattern ? Gene 
• Mon Apr 07 2003 - 17:54:54 EDT
  • ATD OpenSSL Mass Exploiter Analysis (another "/sumthin" scan tool) Joe Stewart 
• Mon Apr 07 2003 - 05:28:04 EDT
  • Re: SMTP probes Christine Kronberg 
• Mon Apr 07 2003 - 16:00:36 EDT
  • Re: Does anyone recognize the scanner that causes this pattern ? dean(at)packethunter.com 
• Mon Apr 07 2003 - 14:40:07 EDT
  • unknown rootkit found in the wild Jerome 
• Mon Apr 07 2003 - 04:50:58 EDT
  • RE: Does anyone recognize the scanner that causes this pattern ? Justin Coffi 
• Mon Apr 07 2003 - 11:34:02 EDT
  • RE: Does anyone recognize the scanner that causes this pattern ? Jerry Shenk 
• Mon Apr 07 2003 - 02:58:58 EDT
  • Re: Does anyone recognize the scanner that causes this pattern ? Laurent Luyckx 
• Sun Apr 06 2003 - 15:24:23 EDT
  • Does anyone recognize the scanner that causes this pattern ? dean(at)packethunter.com 
• Sat Apr 05 2003 - 05:23:22 EST
  • Re: SMTP probes Bojan Zdrnja 
• Sat Apr 05 2003 - 00:09:04 EST
  • Re: SMTP probes Neil Dickey 
• Fri Apr 04 2003 - 08:40:32 EST
  • RE: Logon.dll? Possible root-kit? Jason Pagano 
• Fri Apr 04 2003 - 12:02:03 EST
  • RE: Logon.dll? Possible root-kit? Rob Shein 
• Thu Apr 03 2003 - 20:14:08 EST
  • Re: Logon.dll? Possible root-kit? Harlan Carvey 
• Thu Apr 03 2003 - 20:23:24 EST
  • Re: Logon.dll? Possible root-kit? Nick Jacobsen 
• Fri Apr 04 2003 - 14:22:23 EST
  • SMTP probes Rich Puhek 
• Thu Apr 03 2003 - 11:17:50 EST
  • RE: Logon/Logoff Failure Events Russell Morrison 
• Thu Apr 03 2003 - 08:20:10 EST
  • Re: Logon.dll? Possible root-kit? Harlan Carvey 
• Thu Apr 03 2003 - 10:34:45 EST
  • RE: Logon.dll? Possible root-kit? Rob Shein 
• Thu Apr 03 2003 - 13:04:15 EST
  • RE: Logon/Logoff Failure Events John Ives 
• Thu Apr 03 2003 - 16:45:17 EST
  • RECAP: possible rootkit, maybe partial? Benjamin Tomhave 
• Thu Apr 03 2003 - 14:45:07 EST
  • Re: Increase in Source to Port 445 aladin168 
• Thu Apr 03 2003 - 15:43:05 EST
  • Re: Logon.dll? Possible root-kit? Nick Jacobsen 
• Thu Apr 03 2003 - 14:53:11 EST
  • RE: UDP traffic to net and broadcast addresses Joshua Wright 
• Thu Apr 03 2003 - 12:27:07 EST
  • UDP scans from AOL NS boxes? Mike Mills 
• Thu Apr 03 2003 - 10:13:59 EST
  • RE: Logon.dll? Possible root-kit? Amarante, Rodrigo P. 
• Thu Apr 03 2003 - 10:07:01 EST
  • RE: Increase in Source to Port 445 James C Slora Jr 
• Thu Apr 03 2003 - 07:55:14 EST
  • Re: [0.5OT answer]possible rootkit, maybe partial? nobody 
• Thu Apr 03 2003 - 08:01:22 EST
  • Field Report: New Worm falcon(at)cybersecret.com 
• Thu Apr 03 2003 - 07:59:03 EST
  • Re: possible rootkit, maybe partial? D.C. van Moolenbroek 
• Wed Apr 02 2003 - 23:29:03 EST
  • Re: possible rootkit, maybe partial? Richard Rager 
• Wed Apr 02 2003 - 23:29:21 EST
  • Re: Logon.dll? Possible root-kit? Nick Jacobsen 
• Wed Apr 02 2003 - 23:27:17 EST
  • Re: [CERT] possible rootkit, maybe partial? ePAc 
• Wed Apr 02 2003 - 22:47:05 EST
  • possible rootkit, maybe partial? Benjamin Tomhave 
• Wed Apr 02 2003 - 10:45:14 EST
  • Increase of attempts on port 635 in last couple days Jeff Lane 
• Wed Apr 02 2003 - 21:09:47 EST
  • Logon.dll? Possible root-kit? Nick Jacobsen 
• Wed Apr 02 2003 - 10:24:13 EST
  • RE: SQL Slammer Variant? Rob Shein 
• Wed Apr 02 2003 - 05:12:14 EST
  • UDP traffic to net and broadcast addresses Zen 
• Tue Apr 01 2003 - 22:40:07 EST
  • Re: POP3 logon attempts Mike 
• Tue Apr 01 2003 - 21:54:58 EST
  • Increase in Source to Port 445 Rob Keown 
• Tue Apr 01 2003 - 19:54:23 EST
  • RE: Why alerts on ports 1025-1029, 1036 Leo, Joel 
• Tue Apr 01 2003 - 10:33:56 EST
  • Re: POP3 logon attempts dreamwvr(at)dreamwvr.com 
• Tue Apr 01 2003 - 10:16:28 EST
  • RE: Logon/Logoff Failure Events Robert Wagner 
• Tue Apr 01 2003 - 16:17:06 EST
  • RE: SQL Slammer Variant? Wilson, Aaron J. 
• Tue Apr 01 2003 - 03:49:34 EST
  • Re: POP3 logon attempts Tom Fischer 
• Tue Apr 01 2003 - 10:28:01 EST
  • RE: WebDAV Exploit Lab Jeremy Junginger 
• Tue Apr 01 2003 - 07:53:20 EST
  • Re: SQL Slammer Variant? crucible 
• Tue Apr 01 2003 - 03:14:12 EST
  • RE: Why alerts on ports 1025-1029, 1036 Stuart Wallace 
• Tue Apr 01 2003 - 18:50:44 EST
  • Educational Incident Data Comparison Pilot (X-Post) Alfred Huger 
• Tue Apr 01 2003 - 13:25:24 EST
  • New Article: U.S. Information Security Law, Part 2 Dan Hanson 

  This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:18 EDT