nimda still alive - no timer?

[Thomas Roessler <roessler () does-not-exist org>]

I'm still seeing active Nimda probes within 195/8, so there doesn't 
seem to be a timer which stops the worm from spreading actively.

Concerning the earlier suspicion that the worm must have been 
spreading according to a different algorithm during early stages: 
Please remember that it's indeed using e-mail, and web browsing as 
secondary channels, which can be expeted to be quite efficient at 
crossing /8 prefix boundaries.

--
Thomas Roessler                        http://log.does-not-exist.org/



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com