[Dshield] Cyberkit 2.2 pings.... anyone else getting them?

Ed Truitt ed.truitt at etee2k.net
Tue Oct 21 12:23:42 GMT 2003


John D. wrote:

>>Very Old News...
>>    
>>
>
>It may be old for you,  but I haven't been on this list to appreciate everything that takes place.   What exactly is Nachia?  As mentioned earlier?
>
>  
>
Don't know what "as earlier" means, but Nachi (aka Welchia) is an 
attempt at a "good worm", which tries to locate and disinfect and patch 
systems that were hit with "blaster" (the RPC/DCOM worm launched in 
August.)  It doesn't quite work right, there are reports it may install 
a back-door, and it sends out large amounts of ICMP PING traffic.  
Another instance in which the cure is, if not worse than, at least as 
bad as the disease.

-- 
Cheers,
Ed Truitt
PGP fingerprint:  5368 D25E 468C A250 9833  CCD6 DBAE 9C25 02F9 0AB9
http://www.etee2k.net
http://www.bsatroop148.org

"Note to spammers:  my 'delete' key is connected to YOUR ISP.
 Also, if you send me UCE, I reserve the right to post your spew
on my Web site, with the appropriate color commentary, so that
others may have a good laugh at your expense."





More information about the list mailing list