Re: different CMD.exe access?!?

[Paul Schmehl <pauls () utdallas edu>]

On Tue, 2003-03-11 at 09:58, John Hally wrote:
> Hello,
>
> This is a different looking trace that tripped on the CMD.EXE rule.  I
> usually see a bunch of ../../../cmd.exe, but this one looks different.
> Anyone else seeing this?  it originated from 219.240.31.44, over in Korea:

There is a new version of CodeRed out.  Two bytes have been changed to
alter the date so that it will never stop searching for victims.  That
appears to be what you are seeing.  (I'm seeing it as well.)

-- 
Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/




-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users