Starting: Thu Nov 01 2001 - 10:41:26 CST
Ending: Fri Nov 30 2001 - 15:55:09 CST

• Re: Help with Nimda.E? Zlatko Ignjatovic (Thu Nov 01 2001 - 02:14:41 CST)
• Re: Should I be concerned about? (long reply, grab a sandwich) Chris Brenton (Thu Nov 01 2001 - 08:05:46 CST)
• Strange kernel happenings mstevensonquickhire.com (Thu Nov 01 2001 - 11:12:20 CST)
• FW: Help with Nimda.E? Matt Beck (Thu Nov 01 2001 - 10:56:29 CST)
• Posting to Incidents list, was: Re: Help with Nimda.E? H C (Thu Nov 01 2001 - 11:18:36 CST)
• Re: Should I be concerned about? Jose Carlos Faial (Thu Nov 01 2001 - 11:05:12 CST)
• RE: Strange kernel happenings NESTING, DAVID M (SBCSI) (Thu Nov 01 2001 - 11:52:10 CST)
• Re: Strange kernel happenings Ryan Russell (Thu Nov 01 2001 - 11:54:53 CST)
• Re: Posting to Incidents list, was: Re: Help with Nimda.E? Dan Ellis (Thu Nov 01 2001 - 12:17:01 CST)
• RE: Strange kernel happenings Boyan Krosnov (Thu Nov 01 2001 - 13:28:51 CST)
• Re: Posting to Incidents list, was: Re: Help with Nimda.E? cambriaowt.com (Thu Nov 01 2001 - 15:28:55 CST)
• RE: Posting to Incidents list, was: Re: Help with Nimda.E? Steve (Thu Nov 01 2001 - 21:06:52 CST)
• Strange connections to ports 1214, 6346 and 28800 Jeroen Peters (Fri Nov 02 2001 - 04:10:16 CST)
• Re: Strange connections to ports 1214, 6346 and 28800 Glenn Forbes Fleming Larratt (Fri Nov 02 2001 - 10:47:45 CST)
• Bogus Email ThorHammerofGod.com (Sat Nov 03 2001 - 18:37:40 CST)
• Firewall hits/unknown ports bonkwebchat.chatsystems.com (Sun Nov 04 2001 - 09:06:04 CST)
• Re: Firewall hits/unknown ports Stephen (Sun Nov 04 2001 - 20:39:28 CST)
• Re: Firewall hits/unknown ports Glenn Forbes Fleming Larratt (Sun Nov 04 2001 - 21:28:29 CST)
• RE: Firewall hits/unknown ports Loki (Sun Nov 04 2001 - 22:00:01 CST)
• Re: Firewall hits/unknown ports Valdis.Kletnieksvt.edu (Sun Nov 04 2001 - 22:13:53 CST)
• Re: Bogus Email hvdkooijvanderkooij.org (Mon Nov 05 2001 - 00:50:13 CST)
• RE: Firewall hits/unknown ports Barber, Chris (Mon Nov 05 2001 - 07:04:55 CST)
• Two-Headed Worm - ChinaWorm (analysis) sheib (Mon Nov 05 2001 - 02:06:29 CST)
• Re: Two-Headed Worm - ChinaWorm (analysis) Holger van Lengerich (Mon Nov 05 2001 - 09:59:51 CST)
• Re: Firewall hits/unknown ports freeholderols.com (Mon Nov 05 2001 - 09:59:54 CST)
• Re: Two-Headed Worm - ChinaWorm (analysis) Dave Dittrich (Mon Nov 05 2001 - 12:42:29 CST)
• SYN Flood attack with sequential destination ports? Joshua Wright (Thu Nov 08 2001 - 11:55:04 CST)
• Re: SYN Flood attack with sequential destination ports? Jason Giglio (Thu Nov 08 2001 - 12:38:45 CST)
• Re: Firewall hits/unknown ports Nick FitzGerald (Wed Nov 07 2001 - 13:45:08 CST)
• Problems with modem hanging up after an intrusion Progenit Service S.r.l. (Tue Nov 06 2001 - 02:18:08 CST)
• Strange "port scans" from a spoofed IP Jon R. Kibler (Mon Nov 05 2001 - 17:37:04 CST)
• E-mail with ties to possible malicious website Michael B. Morell (Tue Nov 06 2001 - 11:15:15 CST)
• RE: Strange "port scans" from a spoofed IP NESTING, DAVID M (SBCSI) (Thu Nov 08 2001 - 13:44:54 CST)
• RE: E-mail with ties to possible malicious website -MORE Michael B. Morell (Thu Nov 08 2001 - 13:54:31 CST)
• Problems with modem hanging up after an intrusion Progenit Service S.r.l. (Tue Nov 06 2001 - 02:18:08 CST)
• RE: Problems with modem hanging up after an intrusion McCammon, Keith (Thu Nov 08 2001 - 14:39:15 CST)
• multiple attempts to login via telnet from multiple IP's ... new worm? netnerd (Tue Nov 06 2001 - 04:36:31 CST)
• Corrupted Directories, Intrusions, and Nimda Oh MY Drew E. Gilkey (Thu Nov 08 2001 - 19:48:30 CST)
• Re: Corrupted Directories, Intrusions, and Nimda Oh MY Lew E. Lefton (Thu Nov 08 2001 - 22:38:30 CST)
• Re: Corrupted Directories, Intrusions, and Nimda Oh MY Mike Lewinski (Thu Nov 08 2001 - 23:29:54 CST)
• Analysis of SSH crc32 compensation attack detector exploit Dave Dittrich (Fri Nov 09 2001 - 01:32:32 CST)
• Re: Corrupted Directories, Intrusions, and Nimda Oh MY H C (Fri Nov 09 2001 - 05:54:31 CST)
• Re: SYN Flood attack with sequential destination ports? Joerg Over (Thu Nov 08 2001 - 13:08:50 CST)
• RE: Strange "port scans" from a spoofed IP Keith.Morgan (Fri Nov 09 2001 - 09:58:10 CST)
• Re: Corrupted Directories, Intrusions, and Nimda Oh MY Mike Shaw (Fri Nov 09 2001 - 09:13:29 CST)
• Need Incident Handling Process Framework J Jewitt (Fri Nov 09 2001 - 10:48:47 CST)
• Strange TCP Sweep to 0.0.0.0 Geoff Poer (Fri Nov 09 2001 - 11:34:30 CST)
• Re: multiple attempts to login via telnet from multiple IP's ... new worm? Nathan Einwechter (Thu Nov 08 2001 - 20:12:21 CST)
• RE: Network and Incident Symbology: Comments Wanted Becky Bace (Fri Nov 09 2001 - 14:14:35 CST)
• Re: Analysis of SSH crc32 compensation attack detector exploit Dave Dittrich (Fri Nov 09 2001 - 15:03:34 CST)
• Re: Need Incident Handling Process Framework Yuri Demchenko (Fri Nov 09 2001 - 14:40:00 CST)
• Re: Need Incident Handling Process Framework H C (Fri Nov 09 2001 - 13:48:44 CST)
• RE: SYN Flood attack with sequential destination ports? Joshua Wright (Fri Nov 09 2001 - 14:28:15 CST)
• Passive OS Fingerprinting Toby Miller (Fri Nov 09 2001 - 17:41:35 CST)
• RE: Strange IIS behavior, Keith.Morgan (Mon Nov 12 2001 - 10:12:37 CST)
• RE: Strange "port scans" from a spoofed IP Jason Robertson (Sun Nov 11 2001 - 17:55:33 CST)
• IIS (Possible DoS floating around) Keith.Morgan (Mon Nov 12 2001 - 11:27:13 CST)
• Re: IIS (Possible DoS floating around) Mike Shaw (Mon Nov 12 2001 - 12:03:06 CST)
• RE: IIS (Possible DoS floating around) Keith.Morgan (Mon Nov 12 2001 - 12:18:27 CST)
• Re: IIS (Possible DoS floating around) Shoten (Mon Nov 12 2001 - 13:02:46 CST)
• Re: IIS (Possible DoS floating around) Ezequiel Diaz-Pacheco (Mon Nov 12 2001 - 15:58:55 CST)
• sub-7 Leon de France (Mon Nov 12 2001 - 13:28:15 CST)
• Re: sub-7 Neil Dickey (Mon Nov 12 2001 - 16:22:03 CST)
• RE: IIS (Possible DoS floating around) Keith.Morgan (Mon Nov 12 2001 - 13:12:39 CST)
• Nimda Infections reillyspeakeasy.net (Mon Nov 12 2001 - 17:28:06 CST)
• RE: Nimda Infections Dial Joe (Mon Nov 12 2001 - 18:46:13 CST)
• RE: Nimda Infections Jim Harrison (SPG) (Mon Nov 12 2001 - 18:52:29 CST)
• Re: sub-7 Brice Carlson (Mon Nov 12 2001 - 20:42:59 CST)
• Re: sub-7 Nathan Einwechter (Mon Nov 12 2001 - 21:36:52 CST)
• RE: Nimda Infections Reilly (Mon Nov 12 2001 - 22:31:16 CST)
• RE: Nimda Infections Reilly (Mon Nov 12 2001 - 23:12:14 CST)
• RE: Nimda Infections Reilly (Mon Nov 12 2001 - 23:44:31 CST)
• RE: Nimda Infections Jim Howard (Tue Nov 13 2001 - 08:31:41 CST)
• RE: Nimda Infections w1re p4ir (Tue Nov 13 2001 - 09:49:58 CST)
• Re: Strange TCP Sweep to 0.0.0.0 jared mc (Tue Nov 13 2001 - 10:04:37 CST)
• RE: Nimda Infections Ryan Russell (Tue Nov 13 2001 - 10:25:31 CST)
• Re: sub-7 John Sage (Tue Nov 13 2001 - 10:41:58 CST)
• RE: Nimda Infections Neil Dickey (Tue Nov 13 2001 - 11:03:12 CST)
• Nimda Infections and code red resurgence Russell Fulton (Tue Nov 13 2001 - 16:17:20 CST)
• A Snapshot of Global Internet Worm Activity Dug Song (Tue Nov 13 2001 - 14:34:22 CST)
• Possible DDos Network Creation with ssh crc exploit Mike Grantham (Tue Nov 13 2001 - 17:28:17 CST)
• Re: Possible DDos Network Creation with ssh crc exploit Jose Nazario (Tue Nov 13 2001 - 18:14:55 CST)
• Re: Possible DDos Network Creation with ssh crc exploit Nick FitzGerald (Tue Nov 13 2001 - 19:46:38 CST)
• Strange SMTP Garbage Flood Mike Tibor (Tue Nov 13 2001 - 19:52:28 CST)
• Re: Strange SMTP Garbage Flood macdaddyneo.pittstate.edu (Tue Nov 13 2001 - 20:20:53 CST)
• Re: Possible DDos Network Creation with ssh crc exploit Ryan Russell (Tue Nov 13 2001 - 23:32:02 CST)
• SUB7 (update) Now Netbus too! Brice Carlson (Tue Nov 13 2001 - 22:23:15 CST)
• RE: SUB7 (update) Now Netbus too! Davis, Scott (Wed Nov 14 2001 - 10:36:53 CST)
• Re: SUB7 (update) Now Netbus too! gattaca (Wed Nov 14 2001 - 11:12:44 CST)
• RE: SUB7 (update) Now Netbus too! Davis, Scott (Wed Nov 14 2001 - 11:27:02 CST)
• RE: SUB7 (update) Now Netbus too! Fernando Cardoso (Wed Nov 14 2001 - 11:07:37 CST)
• port 6635 and port 9705 Jim Howard (Wed Nov 14 2001 - 11:29:08 CST)
• Re: Analysis of SSH crc32 compensation attack detector exploit Dave Dittrich (Wed Nov 14 2001 - 12:21:49 CST)
• Re: Strange SMTP Garbage Flood Duncan Simpson (Wed Nov 14 2001 - 10:49:35 CST)
• Re: Strange SMTP Garbage Flood Johannes Verelst (Wed Nov 14 2001 - 15:11:08 CST)
• RE: port 6635 and port 9705 Rob Keown (Wed Nov 14 2001 - 20:45:39 CST)
• RE: port 6635 and port 9705 dschultzmail3.bunt.com (Thu Nov 15 2001 - 02:52:31 CST)
• possible new Nimda variant Howard Gleason (Fri Nov 16 2001 - 07:53:01 CST)
• RE: possible new Nimda variant Steve Halligan (Fri Nov 16 2001 - 10:30:48 CST)
• Re: possible new Nimda variant zeno (Fri Nov 16 2001 - 07:09:50 CST)
• strange log john.huckhushmail.com (Fri Nov 16 2001 - 14:09:01 CST)
• Announcement: New Maillist - Honeypots Lance Spitzner (Mon Nov 19 2001 - 10:52:23 CST)
• MS-SQL Worm? Douglas P. Brown (Tue Nov 20 2001 - 08:54:18 CST)
• Re: MS-SQL Worm? Paul Nasrat (Tue Nov 20 2001 - 11:09:48 CST)
• Re: MS-SQL Worm? Arthur Donkers (Tue Nov 20 2001 - 10:47:16 CST)
• Re: MS-SQL Worm? Arthur Donkers (Tue Nov 20 2001 - 12:50:10 CST)
• Re: MS-SQL Worm? Patrick Andry (Tue Nov 20 2001 - 12:52:43 CST)
• Re: MS-SQL Worm? Johannes Verelst (Tue Nov 20 2001 - 13:11:20 CST)
• Re: MS-SQL Worm? Arthur Donkers (Tue Nov 20 2001 - 10:40:02 CST)
• Re: MS-SQL Worm? jabba (Tue Nov 20 2001 - 11:24:30 CST)
• Fragmentation Concerns... Josh Lutz (Tue Nov 20 2001 - 12:18:26 CST)
• Re: MS-SQL Worm? (no name) (Tue Nov 20 2001 - 14:27:39 CST)
• SSH CRC32? What am I seeing? Shaun Dewberry (Wed Nov 21 2001 - 07:49:11 CST)
• Questions Ihsahn Diablo (Wed Nov 21 2001 - 06:54:02 CST)
• new trojan? Tom Fischer (Wed Nov 21 2001 - 05:46:05 CST)
• Re: SSH CRC32? What am I seeing? SecLists (Wed Nov 21 2001 - 10:36:02 CST)
• RE: new trojan? Rob Keown (Wed Nov 21 2001 - 10:44:14 CST)
• Re: SSH CRC32? What am I seeing? Jose Nazario (Wed Nov 21 2001 - 11:19:59 CST)
• Re: new trojan? Johannes Verelst (Wed Nov 21 2001 - 12:01:23 CST)
• Re: Questions Aaron (Wed Nov 21 2001 - 12:18:25 CST)
• Trinoo/TFN type activity... Grimes, Shawn (NIA/IRP) (Wed Nov 21 2001 - 12:34:47 CST)
• Re: Questions Mike Lewinski (Wed Nov 21 2001 - 12:39:58 CST)
• Re: SSH CRC32? What am I seeing? Martin Roesch (Wed Nov 21 2001 - 15:03:52 CST)
• RE: Questions = Thanks Ihsahn Diablo (Wed Nov 21 2001 - 15:19:44 CST)
• MSLV.exe Rob Keown (Wed Nov 21 2001 - 16:58:10 CST)
• Re: Questions = Thanks Pascal Nobus (Wed Nov 21 2001 - 17:18:07 CST)
• Re: [unisog] MS-SQL Worm? Jeff Anderson-Lee (Wed Nov 21 2001 - 15:25:20 CST)
• RE: MSLV.exe Rob Keown (Wed Nov 21 2001 - 20:54:14 CST)
• Re: Questions = Thanks Devdas Bhagat (Thu Nov 22 2001 - 00:17:06 CST)
• More ssh attempts Marco Slaviero (Thu Nov 22 2001 - 03:24:43 CST)
• Re: More ssh attempts gabriel rosenkoetter (Thu Nov 22 2001 - 13:30:56 CST)
• Re: More ssh attempts Homer Wilson Smith (Thu Nov 22 2001 - 18:46:20 CST)
• Re: More ssh attempts Marco Slaviero (Fri Nov 23 2001 - 03:17:53 CST)
• Need Urgent Info about SQL Worm Matthias Merkel (Thu Nov 22 2001 - 20:24:11 CST)
• RE: Trinoo/TFN type activity... --UPDATE Grimes, Shawn (NIA/IRP) (Fri Nov 23 2001 - 08:29:16 CST)
• Re: Need Urgent Info about SQL Worm Arthur Donkers (Fri Nov 23 2001 - 10:38:23 CST)
• DNS attack triggers snort 'RPC EXPLOIT statdx' alert Russell Fulton (Sun Nov 25 2001 - 16:19:07 CST)
• Possible Trojan/Virus: while.com. Jay D. Dyson (Mon Nov 26 2001 - 00:21:58 CST)
• Re: Possible Trojan/Virus: while.com. joshbwwe.com (Mon Nov 26 2001 - 11:23:34 CST)
• RE: Possible Trojan/Virus: while.com. Fernando Cardoso (Mon Nov 26 2001 - 10:45:51 CST)
• Re: Possible Trojan/Virus: while.com. John Sage (Mon Nov 26 2001 - 11:46:27 CST)
• Re: Possible Trojan/Virus: while.com. Jay D. Dyson (Mon Nov 26 2001 - 12:07:31 CST)
• W32.Badtrans.Bmm storming my mailservers... Raistlin (Mon Nov 26 2001 - 13:30:35 CST)
• RE: W32.Badtrans.Bmm storming my mailservers... Tim M. Crawford (Mon Nov 26 2001 - 13:51:59 CST)
• Malicious use of grc.com MagniHammerofGod.com (Mon Nov 26 2001 - 13:53:52 CST)
• Re: W32.Badtrans.Bmm storming my mailservers... Ryan Tucker (Mon Nov 26 2001 - 13:55:45 CST)
• any1 stumbled across eCkit ? Patrick van Zweden (Mon Nov 26 2001 - 15:21:43 CST)
• W32.Badtrans.Bmm Liudvikas Bukys (Mon Nov 26 2001 - 15:30:54 CST)
• Re: W32.Badtrans.Bmm Marc Fossi (Mon Nov 26 2001 - 15:46:48 CST)
• Re: any1 stumbled across eCkit ? Patrick van Zweden (Mon Nov 26 2001 - 16:18:58 CST)
• Re: W32.Badtrans.Bmm Brett Glass (Mon Nov 26 2001 - 16:13:15 CST)
• Re: W32.Badtrans.Bmm John Sage (Mon Nov 26 2001 - 16:46:52 CST)
• Re: any1 stumbled across eCkit ? Ian Jones (Mon Nov 26 2001 - 17:35:36 CST)
• Re: Malicious use of grc.com Blake McNeill (Tue Nov 27 2001 - 01:46:09 CST)
• Re: Malicious use of grc.com gabriel rosenkoetter (Tue Nov 27 2001 - 22:32:10 CST)
• Windows XP - Still has a Windows NT4 DoS hangover? Bob Fryer (Tue Nov 27 2001 - 23:26:24 CST)
• RE: Windows XP - Still has a Windows NT4 DoS hangover? Adcock, Matt (Wed Nov 28 2001 - 10:58:46 CST)
• New Worm similar to BadTrans.B? Peter Turczak (Wed Nov 28 2001 - 12:15:24 CST)
• Re: New Worm similar to BadTrans.B? zeno (Wed Nov 28 2001 - 08:30:51 CST)
• Re: New Worm similar to BadTrans.B? [Virus Checked] Aron_Croftasc.aon.com (Wed Nov 28 2001 - 12:35:31 CST)
• Strange Traffic.. Vinay Kudithipudi (Thu Nov 29 2001 - 07:11:51 CST)
• Re: any1 stumbled across eCkit ? Fredrik Ostergren (Thu Nov 29 2001 - 03:55:44 CST)
• RE: Strange Traffic.. NESTING, DAVID M (SBCSI) (Thu Nov 29 2001 - 11:06:55 CST)
• RE: any1 stumbled across eCkit ? Ryan Sweat (Thu Nov 29 2001 - 12:25:36 CST)
• Code Red -- AGAIN?!? Steve (Thu Nov 29 2001 - 15:46:39 CST)
• Re: Code Red -- AGAIN?!? Jay D. Dyson (Thu Nov 29 2001 - 18:15:15 CST)
• Re: Code Red -- AGAIN?!? Chip McClure (Thu Nov 29 2001 - 18:43:10 CST)
• RE: Re[2]: Strange Traffic.. NESTING, DAVID M (SBCSI) (Fri Nov 30 2001 - 10:56:33 CST)
• Re: Code Red -- AGAIN?!? Emre Yildirim (Thu Nov 29 2001 - 23:10:36 CST)
• RE: Code Red -- AGAIN?!? Reeves, Michael (GEAE, Compaq) (Fri Nov 30 2001 - 08:29:44 CST)
• Strange Web requests. Geoffrey King (Fri Nov 30 2001 - 10:01:12 CST)
• Re: Strange Traffic.. John Sage (Thu Nov 29 2001 - 23:26:50 CST)
• Re: Strange Web requests. Cabezon Aurélien (Thu Nov 30 2000 - 13:34:56 CST)
• solaris nscd cores j.e.r.k. ROCKS (Fri Nov 30 2001 - 07:43:59 CST)
• Re[2]: Strange Traffic.. Vinay Kudithipudi (Thu Nov 29 2001 - 23:06:37 CST)
• RE: Code Red -- AGAIN?!? Grimes, Shawn (NIA/IRP) (Fri Nov 30 2001 - 07:15:59 CST)
• Proxy Scans to dail up hosts... Grimes, Shawn (NIA/IRP) (Fri Nov 30 2001 - 09:14:27 CST)

Last message date: Fri Nov 30 2001 - 15:55:09 CST
Archived on: Fri Nov 30 2001 - 15:55:11 CST