OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: philippe gros (pgrossympatico.ca)
Date: Fri Aug 10 2001 - 09:03:15 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
    majordomoiss.net Contact issforum-owneriss.net for help with any problems!
    ----------------------------------------------------------------------------

    Hi,
    You are true these are 2 signatures for Code Red I and Code Red II.

    Philippe Gros,GCIA
    Bell Canada

    ----- Original Message -----
    From: "Chris H Mahn" <chmahnduke-energy.com>
    To: <issforumiss.net>
    Sent: Wednesday, August 08, 2001 7:37 AM
    Subject: Code Red /default.ida?NNNNNNNNNNNN

    >
    > TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
    to
    > majordomoiss.net Contact issforum-owneriss.net for help with any
    problems!
    > -------------------------------------------------------------------------- 

    --
>
>
>   When RS shows this event, is the RS decode showing the actual overflow
> characters in the string such as 'NNNNNNNNNNNNNNNN'?
>
>  If so, is there any chance, since I'm seeing both NNNNN and XXXXX as the
> overflow characters, that this would denote a difference between the first
> code red and the one recently discovered that places the trojan on the
> server?
>
>
> Chris Mahn
>
>
>
>
>