Re: hmm...nimda RICHED20.DLL alarms

[Roberto Suarez Soto <robe () alfa21 com>]

On Jan/22, fluid wrote:

> i am getting some of these every day from work (seemingly when users are
> running Office applications). It is the same set of machines every
> day...always attacking the same destination server. scans of the server are
> picking up nothing with any antivirus package i find, and the same is true
> of the workstations.

        I've seen these too. They seem to appear in inofensive and
well-checked networks. I've seen a few nimda .nws and nimda .eml alerts too,
from the same hosts that the RICHED20.DLL came; they all have been checked for
virus, and none was found.

        So, if someone knows something about this, I'm pretty much interested
too :-)

-- 
Roberto Suarez Soto                                     Alfa21 Outsourcing
    robe () alfa21 com                               http://www.alfa21.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users