You have the .ida RedCode worm most likely.
It attacks IIS servers and is self-replicating and jumps from web server to
web server. It has hit over
12,000 servers in the last few days.
You need to check out some of these links
How IIS is vulnerable:
http://www.eeye.com/html/Research/Advisories/AD20010618.html
Patch to fix IIS:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS01-033.asp
Deep analysis of worm:
http://www.eeye.com/html/advisories/codered.zip
I hope that helps.
Chuck Schick
Warp 8, Inc.
www.warp8.com
303-421-5140
----- Original Message -----
From: "Webmaster" <[EMAIL PROTECTED]>
To: "Analog-Help@Lists. Isite. Net" <[EMAIL PROTECTED]>
Sent: Friday, July 20, 2001 6:11 AM
Subject: [analog-help] Problems , Maybe not related (urgent)
: As I was configuring analog yesterday all of a sudden my server started
: acting weird. I am running win 2000 with IIS 5.
: NT AUTHORITY\SYSTEM keeps issuing start and stop commands to IIS.
: Has any one seen this problem and could it be related to analog?
:
: Mark
:
:
: +------------------------------------------------------------------------
: | This is the analog-help mailing list. To unsubscribe from this
: | mailing list, go to
: | http://lists.isite.net/listgate/analog-help/unsubscribe.html
: |
: | List archives are available at
: | http://www.mail-archive.com/[email protected]/
: | http://lists.isite.net/listgate/analog-help/archives/
: | http://www.tallylist.com/archives/index.cfm/mlist.7
: +------------------------------------------------------------------------
:
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
