[Snort-sigs] RE: Snort-sigs digest, Vol 1 #212 - 1 msg
Kent E. Parkin
kparkin at ...526...
Fri Apr 19 07:31:20 EDT 2002
1. (Fwd) Re: ICMP PING speedera - Hacker Tool? (George Bakos)
I understand that web sites use this to find the nearest web site, but I
receive over 12,000 of these packets in just 3 minutes; compared to how many
users I have trying to maybe access these sites, the math doesn't add up;
conclusion: there does seem to be a hacker tool that uses speedera...
From: snort-sigs-request at lists.sourceforge.net
[mailto:snort-sigs-request at lists.sourceforge.net]
Sent: Thursday, April 18, 2002 3:30 PM
To: snort-sigs at lists.sourceforge.net
Subject: Snort-sigs digest, Vol 1 #212 - 1 msg
Send Snort-sigs mailing list submissions to
snort-sigs at lists.sourceforge.net
To subscribe or unsubscribe via the World Wide Web, visit
or, via email, send a message with subject or body 'help' to
snort-sigs-request at lists.sourceforge.net
You can reach the person managing the list at
snort-sigs-admin at lists.sourceforge.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-sigs digest..."
1. RE: Does anyone have a Virus Signature for the"mnsvc.exe"downloadable
trojan yet? (Jim Coyne)
Reply-To: <JCoyne at ...523...>
From: "Jim Coyne" <JCoyne at ...523...>
To: <snort-sigs at lists.sourceforge.net>
Subject: RE: [Snort-sigs] Does anyone have a Virus Signature for
the"mnsvc.exe"downloadable trojan yet?
Date: Wed, 17 Apr 2002 16:00:31 -0400
Here is a qoute from that page.....
"Again, if you haven't done it yet don't delete this file as it is a
necessary part of your Windows program."
You might want to read this also
Now let's get this list back to Snort sig related info ;)
> -----Original Message-----
> From: snort-sigs-admin at lists.sourceforge.net
> [mailto:snort-sigs-admin at lists.sourceforge.net]On Behalf Of Hugo van der
> Sent: Wednesday, April 17, 2002 2:45 PM
> To: snort-sigs mailinglist
> Subject: RE: [Snort-sigs] Does anyone have a Virus Signature for
> the"mnsvc.exe"downloadable trojan yet?
> On Wed, 17 Apr 2002, Jim Coyne wrote:
> > sulfnbk.exe is going to be there regardless, It's part of the OS
> Notice the HOAX in the hostname.
> All email send to me is bound to the rules described on my homepage.
> hvdkooij at ...481... http://hvdkooij.xs4all.nl/
> Don't meddle in the affairs of sysadmins,
> for they are subtle and quick to anger.
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net
End of Snort-sigs Digest
More information about the Snort-sigs