🚀 go-pugleaf

You can also make a million dollars and never pay taxes!
However you choose to rationalize it, hacking compromised systems is
illegal.

If you can, run LaBrea (see http://www.incidents.org/LaBrea/) on your
network to slow down the attacks, or joint FightBack
(http://www.dshield.org/fightback.html) to report infected machines to
their ISPs.  These are legal methods.

Geof


On Sat, 29 Sep 2001 18:14:37 -0400, Tiny Human Ferret <klaatu@clark.net> wrote:
...
>
>c+dir:c\\\Program\ Files and see what you see! Change the +dir part to
>something else, and you can do things like start up a couple of instances of
>the "setup" program so that clueless WinBlows "sysadmins" will at least
>notice that there's something screwy going on with their machines and start
>asking questions and ideally stop their crappy M$ boxes from hammering your
>server. The only cure for the NIMDA worm is to format the system drives and
>reinstall from scratch, sad to say. Maybe they won't run crappy M$
>"bug-riddled piece of filth" software for mission critical applications, and
>will get some cl00 and run Linux or a *BSD.
>
>Basically, almost all of the hosts which are probing to see if you've been
>hit by the Code Red or Code Red II worms, are NIMDA worm hosts checking to
>see if there's that "root.exe" in their local subnets, trying to exploit it
>to TFTP worm components onto that machine. 
>
>Very very nasty, I can only hope it's not eating the military's infotech
>base. Considering when it started replicating, I can only presume that this
>is one part of Phase II of The War.
>
>If the Feds come around and ask you what the hell you think you're doing,
>show them your logs and point out that you were only providing clues to the
>"sysadmins" that their machines were replicating worms across subnets which
>potentially might infect and destroy any level of internet-exposed local,
>state, federal, and military hardware. If they want to haul you in for
>pointing out that they were already compromised by worms, ask them if
>they've ever heard the saying "do not kill the messenger or nobody will ever
>tell you anything".