(no subject)

["Philippe Dhont (Sea-ro)" <Philippe.Dhont () searo be>]

Hi, my snort is working fine since this weekend, i use it on an internal
server.
One of the messages i got was this one:

url[snort] NETBIOS nimda RICHED20.DLL        2002-11-18 10:30:52
10.51.10.104:1055        10.51.10.13:139        TCP  

Now, i got this message from 2 computers, this is very strange because they
don't have the nimda virus.
I checked them, they have a good anti virus and it is up to date.
I scanned the 2 computers completely again (full manual scan) and no virus
was found.
Why do i get the message ?

Regards,


Philippe Dhont 


-------------------------------------------------------
This sf.net email is sponsored by: To learn the basics of securing 
your web site with SSL, click here to get a FREE TRIAL of a Thawte 
Server Certificate: http://www.gothawte.com/rd524.html
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users