Re: New Worm

Article View: demon.security

Article #61

#61

From: Pete Harrison
Date: Tue, 18 Sep 2001 18:45

34 lines
2082 bytes

Yup

We have been probed/attacked regularly this afternoon. At home several
attempts have been made as well.

One of our (patched) machines was broken into. It is now isolated. I shall
have a good look at it tomorrow. Among other things, it seems to be able to
add users and shares if you reset the box so watch your step. it is not a
memory ony beast like code red.


Cheers

Pete
Simon Waters <Simon@wretched.demon.co.uk> wrote in message
news:3BA772DA.7EC35A31@wretched.demon.co.uk...
> I'm seeing lots of port 80 probes today.
>
> Preliminary data at www.incidents.org points to a new Microsoft
> IIS worm, possibly exploiting multiple vulnerabilities, or the
> Unicode vulnerability.
>
> Again looks like it is using the Code Red II aproach of picking
> on servers with similar IP addresses, so I've already seen a
> number of Demon subscribers machines probing my SDU account.
>
> Anyone got more details?
>
> Not worried myself, but looking for detail lest someone expects
> me to help cleanup the mess.
>
> Regards,
>
> Simon

Technical Details

Message-ID: <1000838703.9312.0.nnrp-14.9e981284@news.demon.co.uk>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!news.tele.dk!small.news.tele.dk!212.74.64.35!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!cctc.demon.co.uk!not-for-mail

References: <3BA772DA.7EC35A31@wretched.demon.co.uk>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1065b6,70e3cba6f93eb2a1
X-Google-Attributes: gid1065b6,public
X-Google-ArrivalTime: 2001-09-18 11:46:01 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!news.tele.dk!small.news.tele.dk!212.74.64.35!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!cctc.demon.co.uk!not-for-mail
From: "Pete Harrison" <Peteh@cctc.demon.co.uk>
Newsgroups: demon.security
Subject: Re: New Worm
Date: Tue, 18 Sep 2001 19:45:01 +0100
Message-ID: <1000838703.9312.0.nnrp-14.9e981284@news.demon.co.uk>
References: <3BA772DA.7EC35A31@wretched.demon.co.uk>
NNTP-Posting-Host: cctc.demon.co.uk
X-NNTP-Posting-Host: cctc.demon.co.uk:158.152.18.132
X-Trace: news.demon.co.uk 1000838703 nnrp-14:9312 NO-IDENT cctc.demon.co.uk:158.152.18.132
X-Complaints-To: abuse@demon.net
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 5.00.2615.200
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Lines: 36

Reply to Parent Message