May 2004 - Test - lists.nanog.org

Re: looking for Slammer infectee access link speeds
by vern＠ee.lbl.gov 02 May '04

02 May '04

> I think this is really the most important point. Link speeds and such > are not as significant, maximum packet rates probably are. Where link rates become key is in modeling the worm's dynamics. Because often a single infected machine could fill an access link, additional infections behind that same link didn't change the worm's overall scanning rate; this is unlike other, non-"bandwidth-limited" worms, and changes Slammer's growth to not be the usual exponential/logistic curve. See our paper on Slammer for more details: http://www.computer.org/security/v1n4/j4wea.htm We're now trying to explore that effect, which requires knowing what those bottleneck bandwidth rates were for sets of hosts behind a common bottleneck. Vern

1 0

Re: looking for Slammer infectee access link speeds
by vern＠ee.lbl.gov 02 May '04

02 May '04

[resending from my NANOG-posting address, sigh] > I think a more interesting aspect of this particular worm is that it > only takes a single packet to infect a vulnerable host. As far as I > know no other worm can do this. That was true prior to the March "Witty" worm. > The effect is that even packets to > broadcast or multicast address have the potential to infect. It depends on the specifics of the server being exploited. (In Witty's case, it was passive infection!) > I can tell you some stuff about AS12854. Thanks!, I'll send you the list off-list. Vern

1 0

looking for Slammer infectee access link speeds
by vern＠ee.lbl.gov 02 May '04

02 May '04

With colleagues I'm working on Internet-scale modeling of Slammer's behavior. Its spreading dynamics significantly differed from those of most worms, an effect we're pretty sure is related to the fact that unlike most worms, an infected host's scanning often clogged the host's access link. To evaluate our hypothesis against our measured data, we then need to know what those access link rates were. We have a list of all of the infectees. I've appended the associated AS's (though it's almost shorter to instead list the AS's *not* infected :-). If one of these AS's is yours and you'd be willing to send us the corresponding access link speeds (ideally, as of January 2003, but if not, then today's will do), we'd very much appreciate it. Please send me a note and I'll give you the list of addresses for your AS(s). Any help in this regard much appreciated! Vern 1 3 4 9 11 12 13 14 16 17 18 20 25 26 27 29 31 32 34 38 46 47 52 55 59 71 73 81 87 88 89 91 101 103 104 111 122 127 131 137 149 151 156 159 160 174 188 189 195 196 205 209 210 217 224 225 226 237 239 268 271 278 286 288 291 292 295 297 376 378 513 549 553 557 559 568 577 600 611 668 679 680 684 693 701 702 703 705 706 714 719 760 766 777 786 790 800 802 803 806 812 813 817 818 819 852 855 1103 1110 1113 1114 1124 1128 1136 1161 1201 1205 1213 1220 1221 1224 1226 1237 1239 1241 1249 1251 1257 1267 1273 1290 1299 1312 1317 1342 1351 1453 1454 1458 1459 1460 1463 1464 1468 1489 1503 1512 1559 1569 1653 1657 1659 1668 1680 1692 1704 1706 1727 1736 1739 1741 1742 1746 1749 1760 1761 1767 1781 1784 1785 1790 1798 1832 1835 1836 1842 1853 1887 1889 1897 1901 1902 1916 1930 1935 1955 1967 1968 1970 1982 1998 2015 2018 2025 2033 2042 2044 2047 2048 2050 2055 2060 2107 2108 2110 2116 2118 2119 2140 2148 2150 2151 2152 2156 2193 2200 2202 2259 2379 2381 2386 2418 2422 2426 2495 2496 2497 2498 2500 2501 2503 2504 2508 2510 2512 2514 2516 2518 2519 2521 2524 2527 2529 2544 2547 2548 2551 2553 2554 2561 2572 2578 2586 2588 2592 2607 2609 2611 2614 2637 2641 2646 2647 2669 2683 2685 2686 2687 2693 2697 2698 2701 2706 2708 2711 2712 2715 2764 2818 2819 2820 2828 2830 2831 2833 2834 2839 2846 2847 2848 2852 2854 2856 2857 2860 2874 2878 2894 2895 2897 2899 2900 2901 2904 2905 2907 2914 2915 2920 2933 2939 3043 3058 3064 3112 3132 3141 3144 3152 3209 3215 3216 3218 3228 3233 3235 3239 3240 3242 3243 3245 3246 3248 3249 3253 3254 3255 3257 3261 3262 3265 3267 3268 3269 3277 3287 3291 3292 3293 3300 3301 3302 3303 3304 3305 3307 3308 3312 3313 3316 3320 3323 3324 3326 3327 3328 3329 3330 3335 3336 3339 3340 3352 3354 3356 3359 3363 3369 3370 3386 3388 3390 3392 3404 3446 3447 3449 3450 3452 3454 3462 3464 3479 3491 3502 3505 3527 3549 3553 3561 3575 3578 3582 3586 3591 3592 3593 3598 3599 3602 3608 3632 3633 3634 3638 3644 3659 3661 3663 3671 3676 3679 3681 3685 3699 3700 3701 3707 3714 3720 3728 3733 3737 3738 3741 3742 3748 3756 3758 3764 3776 3784 3786 3790 3794 3801 3807 3816 3833 3839 3851 3855 3899 3900 3901 3912 3925 3931 3932 3933 3965 3998 3999 4004 4039 4043 4045 4048 4057 4058 4130 4134 4148 4150 4151 4158 4181 4183 4187 4190 4193 4198 4200 4201 4208 4230 4231 4261 4264 4265 4267 4268 4270 4274 4278 4279 4307 4314 4319 4323 4324 4355 4358 4364 4372 4385 4434 4454 4469 4470 4492 4497 4509 4511 4513 4515 4519 4528 4538 4544 4562 4565 4569 4570 4581 4589 4595 4605 4609 4616 4618 4621 4628 4637 4645 4648 4651 4657 4658 4662 4663 4665 4668 4669 4670 4671 4673 4680 4682 4685 4688 4691 4692 4694 4698 4702 4704 4712 4713 4716 4721 4725 4727 4732 4736 4738 4739 4741 4745 4747 4750 4751 4755 4758 4759 4760 4761 4763 4765 4766 4767 4768 4770 4775 4776 4780 4781 4782 4783 4786 4787 4788 4791 4793 4795 4799 4800 4802 4803 4804 4808 4812 4813 4814 4816 4817 4818 4833 4834 4835 4837 4841 4842 4847 4854 4855 4922 4926 4927 4943 4961 4965 4993 4997 4999 5000 5002 5006 5009 5015 5033 5048 5049 5051 5056 5060 5061 5071 5078 5081 5089 5377 5378 5379 5381 5384 5385 5386 5387 5388 5389 5390 5391 5394 5396 5397 5400 5403 5407 5408 5409 5410 5415 5416 5417 5419 5422 5424 5425 5427 5430 5432 5433 5435 5461 5462 5463 5464 5466 5467 5468 5470 5471 5481 5482 5483 5486 5489 5493 5501 5503 5504 5511 5515 5516 5517 5518 5519 5520 5522 5523 5532 5533 5536 5537 5538 5539 5546 5550 5551 5561 5567 5568 5571 5578 5583 5587 5593 5594 5602 5603 5604 5606 5609 5610 5615 5617 5620 5626 5628 5631 5639 5641 5642 5650 5651 5653 5656 5661 5668 5669 5670 5690 5691 5692 5693 5696 5702 5704 5713 5718 5719 5726 5738 5739 5742 5750 5752 5760 5767 5769 5773 5778 5779 5783 5784 5786 5789 5800 5972 5982 6041 6056 6057 6059 6062 6064 6065 6067 6073 6074 6076 6078 6079 6083 6100 6104 6106 6112 6122 6126 6127 6128 6130 6133 6137 6140 6147 6157 6163 6167 6181 6187 6192 6197 6198 6200 6203 6221 6222 6248 6260 6261 6263 6280 6287 6295 6298 6300 6304 6306 6311 6315 6316 6322 6325 6327 6332 6337 6342 6347 6349 6350 6354 6355 6356 6360 6364 6365 6366 6367 6368 6372 6379 6380 6381 6382 6383 6384 6385 6386 6387 6388 6389 6395 6400 6402 6405 6407 6412 6423 6428 6429 6435 6440 6448 6453 6458 6459 6461 6467 6471 6472 6479 6485 6487 6488 6493 6496 6503 6505 6506 6508 6510 6517 6521 6522 6528 6534 6535 6536 6539 6541 6559 6561 6568 6570 6580 6582 6598 6601 6615 6619 6620 6621 6629 6636 6639 6648 6650 6653 6656 6661 6663 6677 6678 6690 6694 6696 6697 6700 6702 6703 6706 6711 6713 6714 6717 6721 6726 6728 6730 6731 6735 6736 6739 6740 6744 6746 6752 6756 6764 6767 6770 6772 6778 6779 6785 6788 6794 6798 6799 6800 6803 6805 6813 6820 6821 6822 6828 6830 6846 6848 6849 6850 6853 6854 6856 6857 6858 6859 6862 6863 6866 6867 6871 6882 6888 6903 6912 6913 6914 6938 6939 6948 6954 6967 6971 6977 6981 6982 6983 6993 6994 6995 6996 7005 7010 7011 7012 7015 7017 7018 7021 7029 7030 7038 7046 7050 7055 7057 7062 7064 7065 7066 7071 7078 7087 7091 7098 7106 7118 7120 7125 7132 7136 7142 7146 7151 7169 7176 7177 7181 7184 7185 7192 7201 7203 7204 7207 7212 7228 7235 7252 7254 7258 7260 7263 7268 7270 7271 7276 7284 7296 7303 7309 7314 7315 7324 7332 7333 7336 7337 7341 7344 7346 7351 7355 7377 7380 7381 7386 7393 7395 7397 7418 7438 7441 7453 7455 7456 7459 7460 7462 7465 7468 7470 7472 7473 7474 7476 7479 7482 7485 7487 7491 7492 7496 7497 7498 7502 7503 7506 7516 7517 7522 7524 7534 7535 7538 7540 7543 7544 7545 7552 7557 7558 7560 7562 7564 7567 7569 7570 7571 7572 7574 7579 7586 7590 7598 7604 7613 7616 7620 7621 7623 7624 7626 7627 7629 7633 7638 7641 7642 7643 7645 7649 7651 7652 7654 7656 7657 7658 7670 7671 7672 7679 7687 7690 7693 7710 7713 7719 7722 7725 7727 7735 7737 7738 7744 7745 7751 7752 7753 7757 7774 7776 7781 7782 7784 7788 7794 7795 7796 7799 7806 7828 7829 7832 7835 7837 7843 7845 7849 7853 7855 7866 7868 7877 7891 7892 7893 7894 7896 7902 7908 7911 7925 7928 7939 7944 7949 7951 7955 7956 7958 7963 7968 7992 7997 8000 8001 8002 8007 8010 8011 8014 8015 8016 8018 8022 8025 8039 8043 8047 8048 8051 8052 8054 8057 8058 8060 8061 8062 8063 8065 8070 8072 8077 8100 8103 8111 8112 8113 8114 8120 8134 8138 8143 8148 8151 8159 8166 8167 8175 8191 8193 8194 8195 8196 8197 8201 8204 8206 8208 8209 8212 8220 8222 8224 8226 8227 8228 8245 8246 8248 8249 8251 8254 8256 8262 8263 8266 8267 8272 8277 8278 8285 8286 8289 8293 8304 8308 8311 8319 8327 8333 8339 8341 8342 8343 8345 8346 8350 8355 8357 8358 8359 8362 8365 8376 8377 8379 8382 8386 8391 8393 8394 8395 8399 8402 8404 8406 8413 8421 8422 8424 8425 8426 8434 8436 8437 8445 8447 8449 8452 8457 8468 8469 8470 8472 8473 8474 8481 8482 8486 8493 8495 8503 8505 8508 8509 8510 8512 8514 8515 8517 8524 8527 8530 8534 8540 8542 8546 8551 8553 8555 8560 8563 8564 8565 8567 8573 8579 8580 8581 8582 8584 8585 8591 8592 8593 8594 8607 8611 8612 8615 8617 8622 8624 8629 8641 8642 8643 8648 8668 8672 8685 8687 8689 8691 8696 8705 8708 8710 8711 8717 8724 8728 8732 8733 8736 8737 8740 8741 8743 8744 8745 8747 8749 8751 8752 8753 8755 8756 8760 8761 8764 8767 8771 8778 8781 8782 8785 8795 8801 8807 8818 8820 8823 8824 8825 8828 8829 8833 8838 8841 8844 8846 8851 8856 8859 8865 8869 8876 8879 8881 8884 8895 8896 8897 8899 8902 8903 8905 8910 8911 8912 8921 8922 8923 8926 8928 8934 8946 8954 8961 8968 8970 8972 8975 8980 8982 8984 8990 8999 9000 9003 9019 9021 9024 9031 9032 9038 9041 9051 9064 9066 9069 9070 9072 9076 9079 9083 9085 9087 9095 9103 9105 9106 9110 9112 9116 9119 9120 9121 9127 9129 9132 9141 9143 9145 9146 9150 9151 9152 9154 9155 9158 9163 9167 9172 9173 9177 9186 9191 9193 9196 9198 9200 9202 9211 9216 9225 9227 9229 9230 9237 9238 9240 9241 9244 9247 9251 9264 9265 9269 9270 9271 9273 9274 9277 9280 9292 9299 9303 9304 9305 9306 9307 9308 9310 9313 9314 9316 9317 9318 9321 9323 9325 9326 9328 9329 9334 9340 9345 9351 9354 9365 9367 9368 9370 9371 9374 9378 9381 9386 9391 9394 9398 9406 9411 9415 9416 9419 9420 9421 9430 9431 9436 9443 9455 9457 9458 9459 9462 9463 9470 9471 9472 9476 9480 9482 9484 9486 9488 9489 9491 9497 9498 9501 9505 9506 9512 9513 9519 9523 9524 9526 9533 9534 9541 9543 9546 9549 9551 9553 9556 9557 9570 9572 9578 9581 9583 9584 9593 9595 9600 9605 9607 9609 9614 9615 9617 9618 9622 9625 9628 9635 9637 9639 9644 9646 9649 9652 9656 9658 9674 9676 9683 9684 9686 9687 9689 9691 9695 9697 9701 9706 9714 9723 9725 9729 9740 9741 9751 9753 9754 9755 9758 9760 9761 9762 9768 9769 9774 9775 9778 9780 9782 9789 9790 9794 9796 9797 9800 9801 9802 9803 9806 9807 9808 9811 9812 9813 9814 9815 9816 9817 9818 9819 9820 9822 9823 9824 9826 9829 9830 9831 9833 9834 9835 9837 9839 9840 9842 9844 9848 9850 9851 9853 9859 9860 9867 9868 9870 9872 9875 9881 9884 9889 9892 9900 9903 9905 9908 9910 9911 9916 9918 9919 9924 9925 9929 9930 9931 9934 9939 9942 9943 9949 9954 9956 9957 9958 9962 9965 9971 9976 9977 9979 9982 9988 9989 9991 9993 10002 10007 10010 10013 10021 10024 10029 10030 10032 10035 10039 10042 10044 10045 10046 10049 10052 10070 10071 10073 10076 10077 10086 10088 10091 10094 10097 10098 10104 10107 10111 10113 10115 10125 10126 10130 10135 10139 10145 10148 10159 10160 10162 10165 10171 10174 10176 10180 10182 10184 10186 10189 10192 10197 10199 10204 10210 10212 10217 10223 10224 10231 10236 10238 10239 10242 10243 10248 10257 10269 10271 10277 10288 10292 10297 10311 10314 10316 10318 10326 10348 10355 10357 10358 10362 10364 10377 10381 10396 10397 10412 10421 10429 10430 10434 10435 10436 10437 10439 10445 10453 10461 10464 10469 10474 10475 10481 10487 10489 10497 10507 10530 10532 10538 10545 10550 10560 10561 10569 10586 10587 10589 10592 10594 10602 10617 10631 10650 10651 10653 10661 10667 10671 10674 10676 10678 10680 10681 10685 10692 10700 10701 10705 10708 10715 10719 10733 10736 10738 10739 10741 10755 10778 10787 10789 10790 10796 10804 10812 10818 10821 10823 10834 10835 10838 10840 10843 10844 10848 10849 10856 10865 10867 10880 10882 10883 10887 10910 10912 10913 10921 10928 10930 10933 10937 10938 10942 10950 10954 10965 10970 10978 10979 10994 10996 11012 11014 11020 11023 11036 11039 11045 11050 11051 11060 11061 11063 11069 11071 11078 11081 11084 11091 11094 11103 11107 11115 11123 11131 11136 11139 11145 11146 11149 11151 11155 11157 11172 11178 11188 11189 11194 11197 11204 11215 11216 11220 11221 11231 11232 11233 11240 11252 11260 11267 11269 11270 11271 11279 11290 11292 11293 11303 11304 11305 11311 11315 11318 11320 11333 11338 11342 11351 11366 11367 11370 11383 11386 11388 11398 11401 11403 11404 11417 11418 11419 11426 11427 11430 11432 11439 11440 11447 11451 11456 11459 11462 11468 11473 11474 11477 11478 11486 11491 11492 11499 11500 11509 11515 11524 11525 11530 11532 11533 11550 11554 11556 11557 11562 11563 11574 11575 11586 11587 11588 11589 11590 11595 11598 11604 11606 11608 11610 11612 11646 11647 11653 11656 11658 11659 11664 11666 11668 11672 11677 11679 11683 11686 11690 11696 11700 11704 11706 11707 11718 11734 11738 11739 11745 11753 11754 11755 11766 11769 11770 11774 11778 11779 11796 11808 11814 11817 11830 11833 11834 11841 11844 11845 11846 11847 11849 11850 11852 11853 11858 11859 11867 11869 11872 11881 11882 11888 11891 11896 11898 11899 11908 11913 11916 11918 11921 11935 11942 11951 11955 11960 11964 11967 11970 11975 11976 11981 11984 11986 11990 11992 11996 12003 12005 12006 12007 12009 12013 12015 12020 12021 12024 12026 12028 12033 12042 12049 12059 12066 12076 12078 12083 12087 12093 12096 12097 12100 12103 12110 12111 12112 12117 12122 12124 12126 12127 12129 12131 12135 12136 12139 12145 12150 12167 12173 12178 12179 12180 12181 12188 12198 12202 12231 12233 12251 12252 12261 12262 12263 12270 12271 12282 12284 12293 12294 12296 12301 12302 12305 12306 12312 12321 12322 12324 12329 12332 12334 12336 12337 12338 12346 12347 12348 12350 12352 12353 12356 12357 12359 12361 12364 12369 12371 12373 12375 12386 12390 12392 12394 12402 12406 12412 12418 12429 12430 12435 12440 12443 12445 12447 12455 12457 12464 12469 12470 12471 12474 12476 12479 12480 12486 12489 12492 12493 12496 12497 12501 12504 12513 12518 12519 12521 12524 12530 12541 12542 12543 12548 12550 12552 12558 12565 12570 12574 12575 12578 12579 12581 12594 12597 12599 12605 12607 12609 12610 12616 12626 12636 12637 12644 12651 12668 12670 12675 12676 12680 12684 12685 12690 12693 12703 12705 12708 12709 12715 12721 12735 12738 12741 12742 12751 12764 12767 12775 12778 12779 12788 12793 12797 12810 12816 12830 12831 12840 12846 12850 12854 12859 12867 12871 12874 12876 12880 12882 12883 12885 12902 12907 12909 12917 12918 12920 12926 12927 12931 12932 12942 12946 12949 12963 12967 12968 12969 12971 12975 12978 12994 12997 13005 13006 13012 13030 13037 13046 13049 13062 13066 13069 13071 13078 13080 13086 13089 13091 13092 13095 13099 13100 13104 13110 13112 13122 13123 13124 13125 13126 13127 13129 13132 13136 13142 13143 13152 13155 13156 13161 13165 13170 13174 13177 13184 13193 13194 13202 13215 13216 13222 13226 13227 13228 13237 13249 13251 13257 13263 13270 13272 13284 13285 13286 13302 13303 13311 13315 13319 13321 13326 13328 13333 13341 13343 13345 13353 13354 13361 13364 13367 13370 13385 13388 13389 13405 13406 13407 13408 13409 13412 13432 13444 13464 13476 13488 13489 13490 13493 13494 13498 13513 13516 13525 13526 13536 13549 13560 13563 13571 13576 13581 13582 13591 13593 13601 13606 13609 13610 13615 13618 13620 13640 13645 13646 13649 13657 13659 13661 13662 13664 13666 13669 13670 13671 13672 13674 13675 13676 13680 13682 13685 13693 13695 13703 13706 13733 13744 13749 13756 13768 13773 13776 13777 13778 13789 13790 13791 13796 13802 13806 13811 13815 13818 13828 13842 13844 13855 13857 13868 13871 13878 13890 13911 13917 13937 13950 13956 13960 13990 13999 14000 14001 14007 14022 14026 14038 14039 14041 14048 14051 14059 14080 14090 14092 14093 14103 14104 14110 14113 14117 14131 14137 14150 14155 14156 14166 14174 14178 14188 14194 14202 14204 14209 14217 14249 14259 14263 14265 14275 14280 14283 14288 14291 14292 14296 14325 14335 14342 14345 14348 14351 14359 14361 14366 14367 14370 14380 14390 14392 14398 14416 14419 14420 14433 14437 14453 14456 14461 14464 14467 14468 14472 14480 14492 14496 14501 14505 14517 14522 14535 14537 14543 14551 14552 14553 14558 14571 14574 14576 14585 14589 14591 14594 14598 14612 14629 14633 14634 14636 14644 14646 14647 14650 14654 14658 14667 14671 14675 14677 14679 14690 14697 14710 14719 14727 14730 14741 14742 14744 14745 14751 14755 14758 14765 14784 14788 14793 14796 14818 14824 14827 14828 14835 14840 14849 14858 14861 14868 14884 14896 14900 14904 14938 14954 14955 14962 14974 14985 14987 14988 14989 14991 14992 14999 15011 15014 15024 15031 15034 15035 15065 15066 15076 15081 15083 15087 15102 15105 15119 15121 15125 15129 15138 15142 15146 15149 15153 15180 15201 15206 15216 15218 15221 15227 15236 15246 15247 15266 15267 15270 15272 15278 15282 15290 15305 15311 15337 15373 15389 15390 15395 15412 15415 15418 15435 15440 15444 15450 15457 15463 15464 15467 15470 15471 15472 15475 15485 15488 15491 15496 15497 15500 15501 15506 15509 15510 15512 15516 15517 15525 15527 15531 15535 15542 15544 15548 15554 15557 15558 15563 15569 15577 15589 15598 15600 15602 15605 15611 15612 15623 15640 15648 15651 15654 15656 15659 15662 15665 15670 15675 15683 15685 15691 15694 15695 15699 15703 15704 15706 15710 15717 15721 15723 15729 15732 15735 15736 15738 15739 15742 15743 15744 15747 15755 15756 15758 15759 15763 15766 15770 15773 15782 15801 15802 15803 15804 15830 15833 15834 15836 15837 15842 15857 15861 15873 15874 15879 15893 15898 15915 15924 15928 15935 15943 15959 15970 15971 15974 15979 15994 15997 16000 16012 16014 16016 16023 16034 16040 16044 16054 16063 16082 16086 16088 16095 16102 16106 16111 16117 16130 16150 16156 16163 16173 16175 16178 16186 16188 16190 16191 16202 16206 16207 16217 16218 16229 16231 16237 16245 16246 16248 16251 16265 16272 16276 16283 16284 16285 16290 16300 16307 16318 16329 16333 16334 16338 16339 16341 16342 16350 16359 16360 16397 16399 16402 16405 16406 16413 16422 16424 16440 16442 16445 16455 16461 16467 16473 16482 16484 16491 16506 16518 16519 16524 16526 16531 16532 16549 16550 16553 16557 16581 16582 16592 16596 16597 16601 16603 16604 16608 16609 16617 16622 16626 16629 16635 16637 16642 16643 16664 16685 16687 16699 16712 16713 16715 16724 16732 16735 16738 16740 16750 16784 16787 16791 16794 16795 16804 16810 16811 16812 16814 16818 16835 16852 16871 16878 16889 16895 16906 16941 16945 16949 16960 16966 16967 16976 16989 16992 16998 17014 17015 17017 17019 17046 17049 17054 17055 17060 17086 17089 17106 17111 17113 17119 17129 17135 17142 17173 17175 17176 17184 17192 17200 17226 17227 17228 17231 17236 17252 17263 17277 17287 17324 17332 17339 17340 17354 17356 17379 17380 17396 17401 17403 17408 17409 17416 17422 17426 17429 17430 17439 17443 17444 17447 17448 17451 17452 17453 17464 17465 17474 17477 17479 17483 17486 17488 17490 17495 17502 17506 17511 17523 17524 17527 17529 17531 17534 17536 17537 17539 17546 17547 17551 17552 17557 17559 17575 17577 17578 17584 17589 17590 17593 17594 17603 17608 17620 17621 17622 17623 17625 17636 17638 17639 17640 17642 17645 17653 17657 17658 17660 17666 17668 17673 17675 17676 17677 17681 17686 17697 17698 17705 17707 17713 17716 17726 17727 17737 17739 17747 17754 17758 17761 17762 17766 17770 17771 17772 17773 17774 17775 17778 17783 17787 17803 17809 17813 17816 17818 17820 17824 17827 17828 17829 17830 17836 17839 17850 17857 17861 17862 17864 17870 17872 17877 17881 17887 17888 17895 17909 17910 17911 17913 17914 17917 17925 17927 17930 17932 17941 17948 17949 17956 17962 17963 17964 17966 17968 17970 17971 17974 17975 17976 17977 17978 17979 17982 17988 17992 18023 18026 18027 18028 18029 18031 18033 18035 18038 18041 18042 18049 18059 18068 18074 18075 18094 18099 18101 18105 18108 18109 18114 18118 18123 18125 18129 18136 18140 18144 18157 18161 18163 18164 18169 18171 18174 18175 18176 18179 18181 18182 18196 18199 18201 18202 18207 18220 18221 18222 18228 18233 18239 18249 18257 18276 18286 18287 18298 18299 18300 18301 18302 18304 18310 18314 18316 18319 18321 18323 18324 18327 18329 18331 18335 18338 18341 18343 18345 18355 18374 18376 18391 18401 18403 18435 18449 18474 18479 18515 18530 18540 18549 18558 18560 18565 18566 18586 18591 18594 18606 18614 18618 18638 18643 18649 18650 18657 18677 18678 18687 18695 18699 18704 18710 18712 18719 18724 18734 18739 18747 18750 18756 18781 18783 18794 18798 18806 18809 18814 18832 18834 18847 18866 18869 18871 18876 18881 18885 18886 18895 18900 18905 18915 18942 18945 18986 18988 18990 18999 19015 19016 19019 19024 19029 19057 19062 19064 19065 19082 19089 19092 19094 19106 19108 19114 19115 19116 19118 19130 19135 19149 19157 19177 19180 19181 19182 19191 19192 19194 19199 19200 19206 19235 19241 19256 19261 19262 19271 19284 19287 19290 19291 19292 19294 19296 19309 19326 19332 19358 19361 19365 19367 19381 19384 19390 19396 19402 19405 19406 19414 19422 19429 19444 19461 19463 19464 19471 19479 19515 19525 19530 19548 19550 19562 19579 19586 19588 19604 19609 19632 19662 19685 19723 19748 19752 19754 19800 19817 19833 19835 19842 19846 19849 19852 19863 19864 19873 19885 19887 19888 19893 19902 19926 19939 19940 19960 19962 19963 19974 20001 20002 20006 20012 20015 20021 20043 20044 20046 20056 20068 20071 20081 20082 20088 20105 20112 20115 20120 20124 20126 20128 20130 20136 20139 20141 20161 20172 20191 20194 20214 20228 20231 20234 20252 20255 20266 20271 20284 20289 20290 20299 20300 20304 20312 20334 20355 20375 20401 20406 20412 20413 20436 20447 20448 20459 20460 20472 20473 20477 20483 20484 20485 20495 20499 20500 20507 20521 20522 20531 20542 20547 20560 20569 20575 20578 20590 20602 20607 20621 20626 20632 20639 20646 20647 20648 20649 20650 20651 20655 20674 20676 20677 20679 20680 20689 20704 20707 20712 20718 20723 20738 20742 20746 20759 20760 20773 20777 20786 20789 20803 20804 20805 20807 20811 20822 20823 20830 20834 20847 20848 20853 20858 20869 20870 20875 20882 20888 20901 20903 20907 20914 20923 20926 20928 20931 20952 20959 20961 20963 20969 20974 20976 20988 20993 21003 21034 21040 21050 21055 21057 21069 21073 21078 21125 21127 21130 21136 21143 21148 21152 21155 21159 21166 21175 21185 21191 21213 21214 21215 21220 21221 21224 21234 21246 21250 21267 21280 21284 21287 21295 21309 21311 21314 21332 21341 21353 21360 21375 21378 21390 21392 21396 21404 21409 21413 21425 21435 21446 21453 21455 21473 21476 21480 21482 21487 21491 21494 21501 21502 21503 21508 21510 21522 21523 21529 21535 21536 21545 21548 21554 21560 21561 21562 21565 21570 21571 21582 21586 21591 21599 21612 21615 21624 21637 21653 21657 21684 21686 21687 21694 21698 21709 21724 21730 21735 21737 21741 21747 21762 21766 21774 21776 21783 21793 21804 21826 21828 21829 21832 21840 21844 21845 21847 21848 21852 21864 21865 21867 21873 21874 21875 21889 21908 21910 21915 21918 21919 21922 21924 21936 21949 21954 21973 21980 21984 22019 22026 22030 22040 22047 22067 22070 22087 22099 22102 22117 22129 22136 22148 22152 22153 22154 22158 22166 22180 22187 22192 22195 22205 22245 22269 22275 22282 22286 22291 22298 22302 22307 22311 22313 22318 22323 22324 22325 22329 22332 22333 22339 22343 22346 22351 22356 22378 22384 22385 22391 22398 22408 22431 22435 22442 22489 22500 22511 22517 22520 22549 22560 22566 22573 22592 22594 22606 22619 22625 22637 22639 22646 22653 22658 22684 22709 22710 22712 22728 22729 22747 22751 22759 22768 22772 22773 22781 22799 22818 22827 22830 22833 22834 22837 22847 22852 22867 22884 22903 22908 22909 22914 22919 22920 22925 22926 22927 22934 22938 22954 22958 22967 22968 22969 22980 22987 22992 23001 23002 23005 23011 23033 23052 23054 23080 23093 23100 23105 23106 23126 23131 23140 23141 23156 23184 23201 23205 23215 23216 23235 23237 23241 23248 23250 23258 23265 23267 23272 23275 23278 23292 23298 23300 23314 23342 23343 23345 23352 23357 23372 23383 23400 23464 23465 23484 23497 23504 23514 23518 23520 23531 23532 23539 23541 23552 23556 23610 23646 23649 23655 23668 23669 23673 23674 23691 23695 23714 23723 23726 23731 23743 23752 23753 23768 23785 23837 23957 23975 24586 24587 24589 24602 24612 24620 24627 24636 24638 24665 24672 24689 24696 24703 24709 24729 24730 24731 24745 24746 24767 24792 24793 24794 24826 24827 24829 24833 24835 24839 24841 24846 24851 24852 24860 24862 24863 24881 24884 24915 24916 24922 24931 24938 24940 24945 24951 24956 24961 24971 24983 24992 25008 25013 25019 25032 25041 25071 25074 25098 25108 25110 25113 25122 25123 25124 25138 25139 25161 25171 25176 25177 25182 25184 25186 25195 25196 25223 25227 25233 25234 25242 25250 25292 25306 25346 25349 25351 25353 25360 25394 25405 25424 25438 25454 25463 25487 25509 25553 25586 25612 25620 25622 25664 25683 25685 25689 25698 25700 25702 25709 25720 25737 25738 25745 25749 25754 25766 25776 25782 25789 25790 25795 25816 25847 25852 25853 25892 25897 25904 25913 25921 25933 25941 25945 25956 25957 25970 25973 25977 25979 25994 26004 26046 26054 26058 26060 26068 26081 26091 26096 26097 26112 26115 26116 26146 26174 26198 26206 26209 26210 26228 26247 26265 26284 26292 26308 26335 26339 26365 26367 26375 26379 26407 26431 26446 26473 26480 26488 26513 26557 26571 26598 26602 26603 26608 26609 26617 26623 26674 26688 26706 26733 26744 26788 26793 26809 26830 26831 26843 26859 26860 26862 26864 26896 26909 26921 26938 26959 26967 26984 26996 27193 27197 27202 27209 27215 27218 27246 27257 27266 27267 27274 27313 27323 27343 27364 27375 27382 27387 27404 27422 27425 27431 27445 27446 27455 27464 27474 27477 27485 27503 27513 27552 27553 27557 27569 27594 27596 27613 27621 27630 27650 27699 27716 28692 28701 28710 28764 28804 28840 28847 28851 28885 28908 28938 28986 29003 29037 29129 29212 29259 29340 29471 29484 29486 29531 29558 29684 29690 29737 29748 29754 29773 29780 29803 29859 29863 29867 29882 29895 29900 29907 29944 29951 29955 29958 29968 30013 30023 30075 30085 30110 30147 30173 30176 30198 30216 30238 30256 30282 30307 30309 30336 30458 30477 30496 30504 30522 30546 30569 30589 30599 30600 30619 30620 30639 30641 30691 30707 30712 30713 31145 31153 31771 31817 31823 31834 31848 31851 31870 31886 31888 31912 31914 31915 31917 31930 31935 31950 31981 31995 32034 32064 32154 64627 65406 65534

4 3

Lsass.exe causing shutdown in IE.
by Ejay Hire 01 May '04

01 May '04

Hi all. We're starting to take calls from users about an LSASS.EXE error causing XP to do the 60 seconds till forced reboot, and the normal blaster mitigation and turning on the ICF isn't fixing it. I've been able to reproduce it on one machine locally. Is anyone else seeing it? -Ejay

7 6

Re: Lsass.exe oddities
by J. Oquendo 01 May '04

01 May '04

> > On Sat, 1 May 2004, J. Oquendo wrote: > > McAfee's Stinger takes care of this, or at least supposedly does. > > http://vil.nai.com/vil/stinger maybe some of you guys on the ISP sides can > > place a copy in a public ftp for your users. > > McAfee's Stinger is copyrighted software. Redistribution without > permission or license from McAfee may not be wise. McAfee's sales > people are very particular about not letting people redistribute > their software without paying McAfee. > > Indeed you are correct. I should have made mention of it, although I would hope most would understand that and check those TERMS OF AGREEMENTS. I post links to the page so users can go directly there and get it for themselves but on the flip side I maintain a copy for those 80 year olds who one would spend hours trying to walk them through typing into an address bar. "Where do I find the start menu" Maybe Microsoft should be the one to dish out money and have a tool similar to it bundled in XP that'd auto download and auto scan their OS instead of leaving it to ISP's having to explain every other week that yet another virus is affecting them, and it has nothing to do with connectivity. Oh well. Apologies for not being specific on those licensing issues. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net 'Men have been taught that it is a virtue to agree with others. But the creator is the man who disagrees. Men have been taught that it is a virtue to swim with the current. But the creator is the man who goes against the current. Men have been taught that it is a virtue to stand together. But the creator is the man who stands alone.' -- Ayn Rand"

1 0

Re: Lsass.exe oddities
by J. Oquendo 01 May '04

01 May '04

> Date: Sat, 1 May 2004 14:58:40 -0700 (PDT) > From: Henry Linneweh <hrlinneweh(a)sbcglobal.net> > To: Todd Mitchell - lists <lists(a)ciphin.com>, 'Ejay Hire' > <ejay.hire(a)isdn.net>, nanog(a)merit.edu > Subject: RE: Lsass.exe causing shutdown in IE. McAfee's Stinger takes care of this, or at least supposedly does. http://vil.nai.com/vil/stinger maybe some of you guys on the ISP sides can place a copy in a public ftp for your users. What I've noticed from looking at a few people who were infected with it is, IE and OE gets toasted with OE returning the 0x800ccc15 which on XP has to deal with a bad McAfee install, and or timeouts. Now, I had this one person I was on the phone with who had this error but was still open to ping via DOS prompts and actually resolve out, and have information returned to him. For a quick fix without having to reinstall I had him do a system restore to a few weeks back, then reconnect and download stinger, voila, fixed. Currently running NMAP on the company's /18 to figure see if we can notify users of this issue. Below is output of the session with addresses stripped sil@mvi:~> ping 216.x.x.x PING 216.x.x.x (216.x.x.x): 56 data bytes 64 bytes from 216.x.x.x: icmp_seq=0 ttl=251 time=6.351 ms 64 bytes from 216.x.x.x: icmp_seq=1 ttl=251 time=17.575 ms 64 bytes from 216.x.x.x: icmp_seq=2 ttl=251 time=15.147 ms 64 bytes from 216.x.x.x: icmp_seq=3 ttl=251 time=23.916 ms 64 bytes from 216.x.x.x: icmp_seq=4 ttl=251 time=6.343 ms 64 bytes from 216.x.x.x: icmp_seq=5 ttl=251 time=8.788 ms 64 bytes from 216.x.x.x: icmp_seq=6 ttl=251 time=15.620 ms ^C --- x.x.x.x ping statistics --- 7 packets transmitted, 7 packets received, 0% packet loss round-trip min/avg/max/stddev = 6.343/13.391/23.916/6.056 ms ------------------------------------------------------ xxxxxxx is currently connected to 216.x.x.x ------------------------------------------------------ SessionID: 433419007 Svc: PPP Line/Chan: 1:13:42/000 Slot:Item: 1.03.06/008 Tx/Rx Rate: 45333/31200 IP Address: 216.x.x.x ConnTime: 0:27:55 IdleTime: 0:00:00 Dialed#: 914XXXXXXX Calling#: 914XXXXXXX ------------------------------------------------------ sil@mvi:~> telnet x.x.x.x 5554 Trying 216.x.x.x... Connected to dialin-522-tnt.xxxx.xxxx Escape character is '^]'. 220 OK ^] =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net 'Men have been taught that it is a virtue to agree with others. But the creator is the man who disagrees. Men have been taught that it is a virtue to swim with the current. But the creator is the man who goes against the current. Men have been taught that it is a virtue to stand together. But the creator is the man who stands alone.' -- Ayn Rand"

2 1