Working hypothesis is as follows: Hosts were turned off previously so they didn't show up in routine scanning. Then they were turned on and got infected with Nachi. Nachi patched for MS03-026. Then a scan showed them patched for MS03-026 but not for MS03-039. Then snort reported their infection. So, it appears to be a timing issue rather than something new.
Paul Schmehl ([EMAIL PROTECTED]) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
