[Dshield] RE: scans for MSADC bug?

Johannes Ullrich jullrich at euclidian.com
Mon Nov 25 20:38:51 GMT 2002


On Mon, 25 Nov 2002 10:42:17 -0600
Sue Young <smy at gcmlp.com> wrote:

> You mean this?
> 
> 2002-11-25 09:48:56 80.128.177.24 - xxx.xxx.xxx.xxx 80 HEAD
> /msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe /c+dir+c:\ 500 -

This is Nimda. The ..%5c.. characters are characteristic for the
unicode bug Nimda uses.

-- 
--------------------------------------------------------------------
jullrich at euclidian.com             Collaborative Intrusion Detection
                                         join http://www.dshield.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/list/attachments/20021125/f3845c58/attachment.bin


More information about the list mailing list