[Snort-sigs] Strange CyberKit alert activity

Yackley, Matt Matt.Yackley at ...712...
Mon Aug 18 10:40:02 EDT 2003

It appears that the burst in ICMP CyberKit is related to a new worm for the
recent RPC DCOM flaw.

Here are some links to more information:
Symatec    http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.html
McAfee/NAI   http://vil.nai.com/vil/content/v_100559.htm
ISC 	http://isc.sans.org/diary.html?date=2003-08-18
----incidents.org mailing list post------

More information about the Snort-sigs mailing list