Re: CodeRed-like FTP worm?

[<hvdkooij () vanderkooij org>]

On Wed, 12 Dec 2001, Ascent - Compton, Richard wrote:

> I keep seeing attempted connections to ftp by various boxes in the same
> subnets.  Could this be some sort of scan for vulnerable ftp servers?
> Something like a CodeRed ftp worm?

Most likely one of the scanners looking for open FTP servers to store the 
latest warez.

Hugo.

-- 
All email send to me is bound to the rules described on my homepage.
    hvdkooij () vanderkooij org         http://hvdkooij.xs4all.nl/
            Don't meddle in the affairs of sysadmins,
            for they are subtle and quick to anger.


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com