Snort mailing list archives
Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?
From: Bryan Irvine <bryan.irvine () kingcountyjournal com>
Date: Mon, 26 Jan 2004 16:05:21 -0800
Although Mimail.Q did also come out today, what you're describing is Mydoom/Novarg, which is spreading more rapidly than Mimail from the looks of it. Details from the AV companies are sketchy at this point, but, aside from spreading via SMTP and KaZaA, the copy I looked at appears to start up 63 threads all requesting the index page of www.sco.com every 300 milliseconds.
In that case, I'm installing it on all my servers. :-) ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- New Worm / Virus - WORM_MIMAIL.R? sam (Jan 26)
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Joe Stewart (Jan 28)
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? sam (Jan 28)
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Bryan Irvine (Jan 28)
- RE: Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Brian Gregorcy (Jan 28)
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? sam (Jan 28)
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Bryan Irvine (Jan 28)
- <Possible follow-ups>
- RE: New Worm / Virus - WORM_MIMAIL.R? CGhercoias (Jan 27)
- RE: New Worm / Virus - WORM_MIMAIL.R? Brian M. Diehl (Jan 27)
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R? Joe Stewart (Jan 28)