Snort mailing list archives
RE: different CMD.exe access?!?
From: "Ricardo, Gerson" <gricardo () gableseng com>
Date: Fri, 14 Mar 2003 12:32:37 -0500
Sure Enough, there's anew variant on the loose. It's called CodeRed.F[0]. It would be interesting to see the statistics compared to it's predecessor. /gjr [0] http://securityresponse.symantec.com/avcenter/venc/data/codered.f.html -----Original Message----- From: Jason [mailto:security () brvenik com] Sent: Friday, March 14, 2003 10:33 AM To: bamm () satx rr com Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] different CMD.exe access?!? http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=CODERED.F Bamm Visscher wrote:
I am seeing the same thing from all over (I've been grumblin in #snort all morning). Looks like maybe a variant of CodeRed, could another worm be infecting hosts and then spawning CodeRed scans? At first I thought it was a change in configuration on the network somewhere but the amount of traffic I am seeing is steadily increasing. From 0900-1000(GMT) I had 4 cmd.exe alerts. From 1000-1100: 59 From 1100-1200: 429 From 1200-1300: 1245 From 1300-1400: 1645 From 1400-1500: 1869 From 1500-1600: 1973
------------------------------------------------------- This SF.net email is sponsored by:Crypto Challenge is now open! Get cracking and register here for some mind boggling fun and the chance of winning an Apple iPod: http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.net email is sponsored by:Crypto Challenge is now open! Get cracking and register here for some mind boggling fun and the chance of winning an Apple iPod: http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- different CMD.exe access?!? John Hally (Mar 11)
- Re: different CMD.exe access?!? Bamm Visscher (Mar 11)
- Re: different CMD.exe access?!? Jason (Mar 14)
- Re: different CMD.exe access?!? Phil Wood (Mar 11)
- Re: different CMD.exe access?!? Paul Schmehl (Mar 11)
- <Possible follow-ups>
- RE: different CMD.exe access?!? L. Christopher Luther (Mar 11)
- RE: different CMD.exe access?!? Ricardo, Gerson (Mar 14)
- Re: different CMD.exe access?!? Bamm Visscher (Mar 11)