Security Incidents mailing list archives
Re: Explorer Dr. Watsons
From: "Jeremy 'Circ' Charles" <circi () wwoc org>
Date: Tue, 18 Sep 2001 15:07:21 -0500 (CDT)
On Tue, 18 Sep 2001, Chris Thornberry wrote:
Has anyone been experiencing issues with Dr. Watson Application errors in EXPLORER.EXE. Ever since this morning and the W32.Nimda.A@mm issue some of my servers have had issues trying to run anything. Does anyone know of a relation between the two?
I was wondering about this myself.. My employer has an infected machine that is exhibiting this behavior. The only thing I'm able to do with the machine is get the Task Manager up to confirm that I see the signature processes of the worm (the easiest stand-out of which is something calling itself TFTP). In addition, we're experiencing an ARP storm on our network, presumably as hundreds of infected machines all try to scan/exploit each other. It's a classic case of the argument for going from a flat switched Ethernet with over 700 devices on it to a routed network. I'm seeing over 800 ARP requests per second. :-) ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Explorer Dr. Watsons Chris Thornberry (Sep 18)
- Re: Explorer Dr. Watsons FYOM (Sep 18)
- Re: Explorer Dr. Watsons Jeremy 'Circ' Charles (Sep 18)
- <Possible follow-ups>
- RE: Explorer Dr. Watsons James Paterson (Sep 18)
- RE: Explorer Dr. Watsons Steve Halligan (Sep 18)
- RE: Explorer Dr. Watsons Arnold, Jamie (Sep 18)