Re: nimda subject line

[Thomas Roessler <roessler () does-not-exist org>]

On 2001-09-20 10:38:09 +0200, Thomas Roessler wrote:

> The payload was the same one you see everywhere else, with the 
> usual four-byte variation.

I have to correct the latter part:  There is at least one more 
variation in the worm code than the four-byte sequence I mentioned.

--
Thomas Roessler                        http://log.does-not-exist.org/



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com