Re: NIMDA - ceased ? -

[Neil Dickey <neil () geol niu edu>]

Tomo <tomo () c-wind com> wrote asking:

> Is NIMDA ...(GET /scripts/..%252f../winnt/system32 ...something)
> ceased ?
> 04:54, Dec. 23 UTC is the last access of them, around here.

No, not around here anyway.  My latest hit was this morning, the
27th.  I will say that traffic levels for this one are somewhat
reduced from what they have been, and days may pass without any
hits.

My guess is that what we're seeing now isn't entirely the worm
operating, but that the worm's exploit has been incorporated into
various scripts.

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com