[ale] *OT* But, I need some help.

[Greg Sabino Mullane]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> If this is not Nimda, how does one tell the difference between 
> code red/blue and Nimbda attacks on webserver logs?

I wrote a quick script when nimda first hit: if nothing else, 
you can see the "signatures" of the various worms in the 
DATA section:

http://www.gtsm.com/codewave.pl.txt

Greg Sabino Mullane
greg at turnstep.com
PGP Key: 0x14964AC8 200110220958

-----BEGIN PGP SIGNATURE-----
Comment: http://www.turnstep.com/pgp.html

iQA/AwUBO9QmKrybkGcUlkrIEQKDIACeMIa1dCFZxXcNQe8Vj8PsNRvZ8MYAnRR0
AoXU8PT8z6SgPsBUTAu9eiuf
=8ZSB
-----END PGP SIGNATURE-----



---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
sent to listmaster at ale dot org.