[<prev] [next>] [day] [month] [year] [list]
Message-ID: <871080DEC5874D41B4E3AFC5C400611E06B476F1@UTDEVS02.campus.ad.utdallas.edu>
From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: RE: Possible new variant of Nachi
Working hypothesis is as follows:
Hosts were turned off previously so they didn't show up in routine
scanning. Then they were turned on and got infected with Nachi. Nachi
patched for MS03-026. Then a scan showed them patched for MS03-026 but
not for MS03-039. Then snort reported their infection. So, it appears
to be a timing issue rather than something new.
Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/
Powered by blists - more mailing lists