Security Incidents mailing list archives

Re: NIMDA - ceased ? -

From: Roger Thompson <rogert () mindspring com>
Date: Fri, 27 Dec 2002 18:47:47 -0500

At 02:00 AM 12/26/2002 +0900, you wrote:

Hi, all.

Is NIMDA ...(GET /scripts/..%252f../winnt/system32 ...something)
ceased ?
04:54, Dec. 23 UTC is the last access of them, around here.

Any comments ?


No, it hasn't ceased, but the overall activity is down. See...

www.wormwatch.org

and

www.wormwatch.org/images/WCMthly.html

Roger



Regards

Roger Thompson
Technical Director of Malicious Code Research
TruSecure Corporation
www.trusecure.com
www.wormwatch.org


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.

For more information on this free incident handling, managementand tracking system please see: http://aris.securityfocus.com

Current thread:

NIMDA - ceased ? - Tomo (Dec 27)
- Re: NIMDA - ceased ? - Johannes Ullrich (Dec 27)
- Re: NIMDA - ceased ? - Jay D. Dyson (Dec 27)
- Re: NIMDA - ceased ? - Skip Carter (Dec 27)
- <Possible follow-ups>
- Re: NIMDA - ceased ? - Neil Dickey (Dec 27)
  - Re: NIMDA - ceased ? - James C. Slora Jr. (Dec 27)
- Re: NIMDA - ceased ? - Roger Thompson (Dec 30)