[Dshield] Okay, I'm stumped.

Preston G. Simpson preston.simpson at sfrlaw.com
Wed May 8 21:40:24 GMT 2002

Paul Marsh wrote:
> Looks like Nimda to me.. 
	I would agree with you, except that I've seen plenty of Nimda signatures
in the same logs and this doesn't look like any of them. For one, Nimda
doesn't use the NULL.Printer exploit, to my knowledge, nor does it try to
do anything with PBServer. Does a variant of Nimda that I don't know about
do this?

--Preston G. Simpson
  IS Services
  preston.simpson at sfrlaw.com

More information about the list mailing list