Hi dbtrino, you wrote: > we see a lot of ping traffic and have a lot of users who report of mails > with attachements ~74KB which have not been send by the 'sender'.
The ping traffic might be caused by a worm name W32/Nachi by NAI. See http://vil.nai.com/vil/content/v_100559.htm . It does use the DCOM RPC hole and a flaw in IIS/5.0 as reported in http://www.securityfocus.com/bid/7735/info/ The mails match the report of W32/[EMAIL PROTECTED], see http://vil.nai.com/vil/content/v_100561.htm Michael _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
