Mailing List Archive For incidents@securityfocus.com Apr 2003 By Thread

• Re: UDP packets towards port 38293 (NAV) Nexus (Wed Apr 30 2003 - 17:37:36 EDT)
• Re: UDP packets towards port 38293 (NAV) Russell Fulton (Wed Apr 30 2003 - 15:54:29 EDT)
• Re: Logs showing GET /.hash=... Chris Mann (Wed Apr 30 2003 - 13:30:31 EDT)
• Re: New attack or old Vulnerability Scanner? Jason Falciola (Wed Apr 30 2003 - 13:41:05 EDT)
• Re: New attack or old Vulnerability Scanner? Jason Falciola (Tue Apr 29 2003 - 20:37:19 EDT)
• UDP packets towards port 38293 (NAV) Alan B. Clegg (Tue Apr 29 2003 - 20:51:54 EDT)
• Logs showing GET /.hash=... Keith Bergen (Wed Apr 30 2003 - 09:54:30 EDT)
• RE: Odd IIS log entries James C. Slora, Jr. (Wed Apr 30 2003 - 09:28:08 EDT)
• RE: New CodeRed strain? -- UPDATE larosa, vjay (Tue Apr 29 2003 - 22:38:03 EDT)
• Administrivia: SPAM control, vacation messages, and the like. Dan Hanson (Wed Apr 30 2003 - 12:09:24 EDT)
• Re: New attack or old Vulnerability Scanner? Mark Embrich (Tue Apr 29 2003 - 14:34:03 EDT)
• Re: New CodeRed strain? -- UPDATE Justin Pryzby (Tue Apr 29 2003 - 18:13:53 EDT)
• Re: New attack or old Vulnerability Scanner? jac (Tue Apr 29 2003 - 16:21:49 EDT)
• Re: Anyone seen this UDP source port 7001 traffic? Jose Nazario (Mon Apr 28 2003 - 13:12:44 EDT)
• Re: Anyone seen this UDP source port 7001 traffic? Tina Bird (Mon Apr 28 2003 - 15:30:52 EDT)
• undetected DDOS Chris Cahill (Mon Apr 28 2003 - 15:30:55 EDT)
• Re: lots of port 0 scannings Neil Dickey (Mon Apr 28 2003 - 15:28:36 EDT)
• RE: Anyone seen this UDP source port 7001 traffic? Taz (Mon Apr 28 2003 - 13:14:53 EDT)
• Re: lots of port 0 scannings Brad Doctor (Mon Apr 28 2003 - 13:19:09 EDT)
• Odd IIS log entries Hahn, Jacob (Mon Apr 28 2003 - 13:27:11 EDT)
• Re: SMTP Scans Chris Boyd (Mon Apr 28 2003 - 13:25:15 EDT)
• Re: New CodeRed strain? -- UPDATE Frank Knobbe (Mon Apr 28 2003 - 13:13:11 EDT)
• Re: New attack or old Vulnerability Scanner? rhandwerker(at)iss.net (Mon Apr 28 2003 - 12:45:20 EDT)
• RE: New attack or old Vulnerability Scanner? Keith (Fri Apr 25 2003 - 17:40:40 EDT)
• lots of port 0 scannings SB CH (Sun Apr 27 2003 - 20:51:58 EDT)
• Re: New CodeRed strain? Frank Knobbe (Fri Apr 25 2003 - 15:23:57 EDT)
• Re: Anyone seen this UDP source port 7001 traffic? Michael Lau (Sat Apr 26 2003 - 20:34:29 EDT)
• Re: New attack or old Vulnerability Scanner? Jason Falciola (Sat Apr 26 2003 - 07:56:17 EDT)
• New CodeRed strain? Frank Knobbe (Fri Apr 25 2003 - 14:55:13 EDT)
• RE: SMTP Scans paul(at)doevil.com (Sat Apr 26 2003 - 03:09:35 EDT)
• Re: SMTP Scans Hoof Hearted (Fri Apr 25 2003 - 20:21:57 EDT)
• RE: New attack or old Vulnerability Scanner? James C. Slora, Jr. (Fri Apr 25 2003 - 15:00:56 EDT)
• Scans on TCP port 9631 + other unknown ports Kevin Patz (Fri Apr 25 2003 - 08:10:30 EDT)
• Re: msamba Tobias Klein (Fri Apr 25 2003 - 06:06:02 EDT)
• New attack or old Vulnerability Scanner? Mark Embrich (Thu Apr 24 2003 - 19:43:43 EDT)
• Re: Trojan found... Patrick Nolan (Thu Apr 24 2003 - 16:58:18 EDT)
• Re: SMTP Scans Kurt Seifried (Thu Apr 24 2003 - 15:43:20 EDT)
• Re: IP Spoofs in the log - not sure what to do next aladin168 (Thu Apr 24 2003 - 10:12:04 EDT)
• Re: Trojan found... aladin168 (Thu Apr 24 2003 - 10:22:50 EDT)
• RE: SMTP Scans Jimi Thompson (Wed Apr 23 2003 - 23:15:57 EDT)
• Re: protocol watcher Jose Nazario (Wed Apr 23 2003 - 10:22:29 EDT)
• Re: POP3 logon attempts Steve Cody (Tue Apr 22 2003 - 17:44:06 EDT)
• RE: Company being War Dialed nospam(at)none.net (Tue Apr 22 2003 - 12:33:23 EDT)
• protocol watcher Justin Pryzby (Tue Apr 22 2003 - 11:03:06 EDT)
• RE: SMTP Scans Luc Somers (Tue Apr 22 2003 - 11:42:36 EDT)
• Re: msamba noconflic (Tue Apr 22 2003 - 11:14:48 EDT)
• Re: msamba noconflic (Tue Apr 22 2003 - 10:48:34 EDT)
• RE: SMTP Scans Mally Mclane (Tue Apr 22 2003 - 10:40:28 EDT)
• Re: msamba Steve Bromwich (Tue Apr 22 2003 - 10:08:18 EDT)
• Re: FW: IP Spoofs in the log - not sure what to do next David Hawley (Tue Apr 22 2003 - 04:13:52 EDT)
• Re: msamba Nikola Pepelishev (Tue Apr 22 2003 - 04:12:00 EDT)
• Re: msamba William Salusky (Tue Apr 22 2003 - 01:20:00 EDT)
• RE: SMTP Scans Rob Shein (Mon Apr 21 2003 - 18:50:33 EDT)
• Re: Tracking proxies on port 1180/1182 Michael Scheidell (Mon Apr 21 2003 - 15:56:46 EDT)
• RE: Company being War Dialed James.Jackson(at)broadwing.com (Mon Apr 21 2003 - 15:07:02 EDT)
• Re: Tracking proxies on port 1180/1182 George Bakos (Mon Apr 21 2003 - 15:55:45 EDT)
• Tracking proxies on port 1180/1182 Joe Stewart (Mon Apr 21 2003 - 14:54:48 EDT)
• Re: msamba Paulo Abrantes (Mon Apr 21 2003 - 14:00:54 EDT)
• RE: Strange, scary, subtle trojan Dowling, Gabrielle (Sun Apr 20 2003 - 14:35:35 EDT)
• Re: FW: IP Spoofs in the log - not sure what to do next crawford charles (Mon Apr 21 2003 - 13:30:52 EDT)
• RE: IP Spoofs in the log - not sure what to do next David Klotz (Mon Apr 21 2003 - 09:27:40 EDT)
• Re: Company being War Dialed public list (Mon Apr 21 2003 - 02:06:03 EDT)
• RE: port 139 syn-fin scans Toby Miller (Sun Apr 20 2003 - 21:08:45 EDT)
• Re: Company being War Dialed James.Phillips(at)mutualofomaha.com (Mon Apr 21 2003 - 13:15:40 EDT)
• msamba Steve Bromwich (Mon Apr 21 2003 - 11:41:27 EDT)
• Re: port 139 syn-fin scans Muchacki Robert (Sun Apr 20 2003 - 16:02:52 EDT)
• RE: Company being War Dialed Curt Purdy (Sun Apr 20 2003 - 10:41:57 EDT)
• Re: SMTP Scans Hoof Hearted (Sun Apr 20 2003 - 07:07:04 EDT)
• RE: port 139 syn-fin scans Kevin Hodle (Mon Apr 21 2003 - 01:51:33 EDT)
• Re: port 139 syn-fin scans Scott A. McIntyre (Sun Apr 20 2003 - 05:11:21 EDT)
• RE: IP Spoofs in the log - not sure what to do next Curt Purdy (Sun Apr 20 2003 - 11:06:45 EDT)
• Re: Intresting problem concerning libresolv.so.2 Paul Gear (Sun Apr 20 2003 - 02:00:29 EDT)
• Re: Company being War Dialed Kurt Seifried (Sun Apr 20 2003 - 03:02:44 EDT)
• Mo'Logs sf(at)noameppel.com (Sat Apr 19 2003 - 22:50:04 EDT)
• Re: Intresting problem concerning libresolv.so.2 Paul Gear (Fri Apr 18 2003 - 23:53:21 EDT)
• Re: Company being War Dialed Brett Glass (Sun Apr 20 2003 - 00:45:26 EDT)
• re: port 5168 Harlan Carvey (Fri Apr 18 2003 - 06:54:04 EDT)
• port 139 syn-fin scans Skip Carter (Fri Apr 18 2003 - 14:51:32 EDT)
• Strange, scary, subtle trojan Jeff Kell (Fri Apr 18 2003 - 01:01:15 EDT)
• Re: Trojan found... Harlan Carvey (Thu Apr 17 2003 - 19:08:36 EDT)
• Re: Trojan found... Les Ault (Thu Apr 17 2003 - 21:47:49 EDT)
• Company being War Dialed Fred Kreitzberg (Thu Apr 17 2003 - 19:13:03 EDT)
• Re: Intresting problem concerning libresolv.so.2 Kevin Reardon (Thu Apr 17 2003 - 20:05:22 EDT)
• IP Spoofs in the log - not sure what to do next Chris Corbett (Thu Apr 17 2003 - 18:17:53 EDT)
• Anyone seen this UDP source port 7001 traffic? Faron.Golden(at)Gunter.AF.mil (Thu Apr 17 2003 - 17:53:07 EDT)
• Intresting problem concerning libresolv.so.2 Sam Evans (Tue Apr 15 2003 - 15:00:19 EDT)
• Port 6666 Scans Thomas Vincent (Wed Apr 16 2003 - 09:51:26 EDT)
• Trojan found... Les Ault (Tue Apr 15 2003 - 20:24:49 EDT)
• Re: Logging of connects to port 6346 Nicolas Couture (Tue Apr 15 2003 - 13:16:38 EDT)
• port 5168 Molony, Duncan (Thu Apr 17 2003 - 14:03:42 EDT)
• Re: Port 17300 probes? Joe Stewart (Tue Apr 15 2003 - 17:18:38 EDT)
• RE: Logging of connects to port 6346 LordInfidel (Tue Apr 15 2003 - 17:30:38 EDT)
• Re: Port 17300 probes? Joris De Donder (Tue Apr 15 2003 - 14:38:55 EDT)
• Re: New trojan? Old trojan with new characteristics? Anyone seenthis? Mike Parkin (Tue Apr 15 2003 - 11:37:48 EDT)
• Logging of connects to port 6346 kbergen(at)bellsouth.net (Mon Apr 14 2003 - 18:58:03 EDT)
• Port 3366 activity defaillance(at)hushmail.com (Tue Apr 15 2003 - 11:35:28 EDT)
• Re: New trojan? Old trojan with new characteristics? Anyone seenthis? vex86(at)rogers.com (Mon Apr 14 2003 - 19:57:00 EDT)
• Re: Port 17300 probes? MARLON BORBA (Mon Apr 14 2003 - 12:38:56 EDT)
• Re: Port 17300 probes? Kevin Patz (Mon Apr 14 2003 - 15:12:02 EDT)
• Re: Port 17300 probes? Gerd Feiner (Mon Apr 14 2003 - 12:37:54 EDT)
• Port 17300 probes? incidents(at)mwwm.net (Mon Apr 14 2003 - 02:50:45 EDT)
• Re: New trojan? Old trojan with new characteristics? Anyone seenthis? Alex Lambert (Thu Apr 10 2003 - 20:55:08 EDT)
• New trojan? Old trojan with new characteristics? Anyone seen this? Mike Parkin (Wed Apr 09 2003 - 18:51:11 EDT)
• New SecurityFocus article: Steganography Revealed Dan Hanson (Wed Apr 09 2003 - 12:38:50 EDT)
• New SecurityFocus article: Specter: A Commercial Honeypot Solution for Windows Dan Hanson (Wed Apr 09 2003 - 12:37:17 EDT)
• Re: Does anyone recognize the scanner that causes this pattern ? Gene (Sun Apr 06 2003 - 19:00:55 EDT)
• ATD OpenSSL Mass Exploiter Analysis (another "/sumthin" scan tool) Joe Stewart (Mon Apr 07 2003 - 17:54:54 EDT)
• Re: SMTP probes Christine Kronberg (Mon Apr 07 2003 - 05:28:04 EDT)
• Re: Does anyone recognize the scanner that causes this pattern ? dean(at)packethunter.com (Mon Apr 07 2003 - 16:00:36 EDT)
• unknown rootkit found in the wild Jerome (Mon Apr 07 2003 - 14:40:07 EDT)
• RE: Does anyone recognize the scanner that causes this pattern ? Justin Coffi (Mon Apr 07 2003 - 04:50:58 EDT)
• RE: Does anyone recognize the scanner that causes this pattern ? Jerry Shenk (Mon Apr 07 2003 - 11:34:02 EDT)
• Re: Does anyone recognize the scanner that causes this pattern ? Laurent Luyckx (Mon Apr 07 2003 - 02:58:58 EDT)
• Does anyone recognize the scanner that causes this pattern ? dean(at)packethunter.com (Sun Apr 06 2003 - 15:24:23 EDT)
• Re: SMTP probes Bojan Zdrnja (Sat Apr 05 2003 - 05:23:22 EST)
• Re: SMTP probes Neil Dickey (Sat Apr 05 2003 - 00:09:04 EST)
• RE: Logon.dll? Possible root-kit? Jason Pagano (Fri Apr 04 2003 - 08:40:32 EST)
• RE: Logon.dll? Possible root-kit? Rob Shein (Fri Apr 04 2003 - 12:02:03 EST)
• Re: Logon.dll? Possible root-kit? Harlan Carvey (Thu Apr 03 2003 - 20:14:08 EST)
• Re: Logon.dll? Possible root-kit? Nick Jacobsen (Thu Apr 03 2003 - 20:23:24 EST)
• SMTP probes Rich Puhek (Fri Apr 04 2003 - 14:22:23 EST)
• RE: Logon/Logoff Failure Events Russell Morrison (Thu Apr 03 2003 - 11:17:50 EST)
• Re: Logon.dll? Possible root-kit? Harlan Carvey (Thu Apr 03 2003 - 08:20:10 EST)
• RE: Logon.dll? Possible root-kit? Rob Shein (Thu Apr 03 2003 - 10:34:45 EST)
• RE: Logon/Logoff Failure Events John Ives (Thu Apr 03 2003 - 13:04:15 EST)
• RECAP: possible rootkit, maybe partial? Benjamin Tomhave (Thu Apr 03 2003 - 16:45:17 EST)
• Re: Increase in Source to Port 445 aladin168 (Thu Apr 03 2003 - 14:45:07 EST)
• Re: Logon.dll? Possible root-kit? Nick Jacobsen (Thu Apr 03 2003 - 15:43:05 EST)
• RE: UDP traffic to net and broadcast addresses Joshua Wright (Thu Apr 03 2003 - 14:53:11 EST)
• UDP scans from AOL NS boxes? Mike Mills (Thu Apr 03 2003 - 12:27:07 EST)
• RE: Logon.dll? Possible root-kit? Amarante, Rodrigo P. (Thu Apr 03 2003 - 10:13:59 EST)
• RE: Increase in Source to Port 445 James C Slora Jr (Thu Apr 03 2003 - 10:07:01 EST)
• Re: [0.5OT answer]possible rootkit, maybe partial? nobody (Thu Apr 03 2003 - 07:55:14 EST)
• Field Report: New Worm falcon(at)cybersecret.com (Thu Apr 03 2003 - 08:01:22 EST)
• Re: possible rootkit, maybe partial? D.C. van Moolenbroek (Thu Apr 03 2003 - 07:59:03 EST)
• Re: possible rootkit, maybe partial? Richard Rager (Wed Apr 02 2003 - 23:29:03 EST)
• Re: Logon.dll? Possible root-kit? Nick Jacobsen (Wed Apr 02 2003 - 23:29:21 EST)
• Re: [CERT] possible rootkit, maybe partial? ePAc (Wed Apr 02 2003 - 23:27:17 EST)
• possible rootkit, maybe partial? Benjamin Tomhave (Wed Apr 02 2003 - 22:47:05 EST)
• Increase of attempts on port 635 in last couple days Jeff Lane (Wed Apr 02 2003 - 10:45:14 EST)
• Logon.dll? Possible root-kit? Nick Jacobsen (Wed Apr 02 2003 - 21:09:47 EST)
• RE: SQL Slammer Variant? Rob Shein (Wed Apr 02 2003 - 10:24:13 EST)
• UDP traffic to net and broadcast addresses Zen (Wed Apr 02 2003 - 05:12:14 EST)
• Re: POP3 logon attempts Mike (Tue Apr 01 2003 - 22:40:07 EST)
• Increase in Source to Port 445 Rob Keown (Tue Apr 01 2003 - 21:54:58 EST)
• RE: Why alerts on ports 1025-1029, 1036 Leo, Joel (Tue Apr 01 2003 - 19:54:23 EST)
• Re: POP3 logon attempts dreamwvr(at)dreamwvr.com (Tue Apr 01 2003 - 10:33:56 EST)
• RE: Logon/Logoff Failure Events Robert Wagner (Tue Apr 01 2003 - 10:16:28 EST)
• RE: SQL Slammer Variant? Wilson, Aaron J. (Tue Apr 01 2003 - 16:17:06 EST)
• Re: POP3 logon attempts Tom Fischer (Tue Apr 01 2003 - 03:49:34 EST)
• RE: WebDAV Exploit Lab Jeremy Junginger (Tue Apr 01 2003 - 10:28:01 EST)
• Re: SQL Slammer Variant? crucible (Tue Apr 01 2003 - 07:53:20 EST)
• RE: Why alerts on ports 1025-1029, 1036 Stuart Wallace (Tue Apr 01 2003 - 03:14:12 EST)
• Educational Incident Data Comparison Pilot (X-Post) Alfred Huger (Tue Apr 01 2003 - 18:50:44 EST)
• New Article: U.S. Information Security Law, Part 2 Dan Hanson (Tue Apr 01 2003 - 13:25:24 EST)