<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Code red- Returning?</TITLE>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1141" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=590390218-18032003><FONT face=Arial color=#0000ff size=2>We're
still in the propogation mode, until the 20th.</FONT></SPAN></DIV>
<DIV><SPAN class=590390218-18032003><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=590390218-18032003><FONT face=Arial color=#0000ff size=2><A
href="http://www.cert.org/advisories/CA-2001-23.html">http://www.cert.org/advisories/CA-2001-23.html</A></FONT></SPAN></DIV>
<DIV><SPAN class=590390218-18032003><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=590390218-18032003><FONT face=Arial color=#0000ff size=2>Unless
their clocks are off by 3 days, they're in the wrong mode
...</FONT></SPAN></DIV>
<DIV><SPAN class=590390218-18032003><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=590390218-18032003><FONT face=Arial color=#0000ff
size=2>However, since 1100EST 3-17-03, we've seen a steady uptick also.
Also, some other tools must be attempting to use the same exploits, but they are
more ferocious, creating thousands of attempts within a few minutes, exploiting
the same vulnerabilities.</FONT></SPAN></DIV>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid">
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> owner-nanog@merit.edu
[mailto:owner-nanog@merit.edu]<B>On Behalf Of </B>McBurnett,
Jim<BR><B>Sent:</B> Tuesday, March 18, 2003 12:50 PM<BR><B>To:</B>
nanog@merit.edu<BR><B>Subject:</B> Code red- Returning?<BR><BR></FONT></DIV><!-- Converted from text/rtf format -->
<P><FONT face=Arial size=2>Has anyone out there noticed an increase in a
Code-Red patterned virus?</FONT> <BR><FONT face=Arial size=2>I know about the
Microsoft bug that came out yesterday/last night.</FONT> <BR><FONT face=Arial
size=2>But I am seeing the same symptoms as Code Red,</FONT> <BR><FONT
face=Arial size=2>800+ hits in the last 12 hours, from the same Class A
network I am on.</FONT> <BR><FONT face=Arial size=2>The amount is increasing
per hour..</FONT> <BR><FONT face=Arial size=2>It started with 50 the first
hour and now it just about 150 an hour...</FONT> </P>
<P><FONT face=Arial size=2>Thoughts?</FONT> </P>
<P><FONT face=Arial size=2>thanks,</FONT> <BR><FONT face=Arial
size=2>Jim</FONT> </P><BR></BLOCKQUOTE></BODY></HTML>