Snort mailing list archives
Nimda infections..
From: "Franki" <frankieh () vianet net au>
Date: Thu, 20 Sep 2001 14:55:34 +0800
Hi all, I just thought I'd mention something,, last night I posed a URL to an infected server to show people what it does... The reason I only gave a token warning about it, was because in my case, the file asked to be downloaded and where I wanted to save it. It turns out that it does that because I have every MS updated loaded on it.. if you have a version of IE prior to 6 (or an unpatched earlier version), and you go to a site thats infected by Nimda,, it will autodownload the .eml file and you get infected.. I was unaware of this last night and figured everyone would be asked if they wanted to download the file,,, to which you could cancel... My apologies.. rgds Frank _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Nimda Rules Lists (Sep 19)
- Re: Nimda Rules Rich Adamson (Sep 19)
- Re: Nimda Rules Phil Wood (Sep 19)
- Nimda infections.. Franki (Sep 20)
- Re: Nimda Rules Phil Wood (Sep 19)
- <Possible follow-ups>
- Re: Nimda Rules Dr SuSE (Sep 19)
- Re: Nimda Rules Rich Adamson (Sep 19)