New Worm

Article View: demon.security

Article #60

#60

From: Simon Waters
Date: Tue, 18 Sep 2001 16:14

18 lines
1575 bytes

I'm seeing lots of port 80 probes today.

Preliminary data at www.incidents.org points to a new Microsoft
IIS worm, possibly exploiting multiple vulnerabilities, or the
Unicode vulnerability.

Again looks like it is using the Code Red II aproach of picking
on servers with similar IP addresses, so I've already seen a
number of Demon subscribers machines probing my SDU account.

Anyone got more details? 

Not worried myself, but looking for detail lest someone expects
me to help cleanup the mess.

	Regards,

	Simon

Technical Details

Message-ID: <3BA772DA.7EC35A31@wretched.demon.co.uk>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!news.tele.dk!small.news.tele.dk!212.74.64.35!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1065b6,70e3cba6f93eb2a1,start
X-Google-Attributes: gid1065b6,public
X-Google-ArrivalTime: 2001-09-18 09:15:02 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!news.tele.dk!small.news.tele.dk!212.74.64.35!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail
From: Simon Waters <Simon@wretched.demon.co.uk>
Newsgroups: demon.security
Subject: New Worm
Date: Tue, 18 Sep 2001 17:14:18 +0100
Organization: Eighth Layer Limited
Message-ID: <3BA772DA.7EC35A31@wretched.demon.co.uk>
NNTP-Posting-Host: wretched.demon.co.uk
X-NNTP-Posting-Host: wretched.demon.co.uk:193.237.109.203
X-Trace: news.demon.co.uk 1000829657 nnrp-10:992 NO-IDENT wretched.demon.co.uk:193.237.109.203
X-Complaints-To: abuse@demon.net
X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.19 i686)
X-Accept-Language: en-GB, en-US, en
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 18