Re: massive cmd.exe and root.exe attempts

[screamer <screamer () logoff com>]

Sean Kelly wrote:

> On Tue, 18 Sep 2001, pbeam () agea com wrote:
>
> > I am as well being hit by this worm.  Everything seems to be coming from
> > the same class A 64.*. 
>
>         Not so here.  Nearly all my hits are coming from 217.something.
>
> --
> Sean Kelly

Almost all of the ones hitting here come from addresses with the same 
first octet in the IP address as my boxen have, possibly an intentional 
behaviour.

> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management 
> and tracking system please see: http://aris.securityfocus.com




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com