Thnx for the mail Chuck,
Infact, I got a phone call from a client yesterday and he was freaked out coz
all the entries in IIS got stopped and couldnot start them. I tried palying with
services and stuff and told him he definietly has a virus.
Early today, I read about this worm. And the client had 25,000 infected files.
Good Luck guys,
Wissam
PS: Is it related to chineese or whatever.
Chuck Schick [[EMAIL PROTECTED]] wrote:
> You have the .ida RedCode worm most likely.
>
> It attacks IIS servers and is self-replicating and jumps from web server to
> web server. It has hit over
> 12,000 servers in the last few days.
>
> You need to check out some of these links
>
> How IIS is vulnerable:
> http://www.eeye.com/html/Research/Advisories/AD20010618.html
>
> Patch to fix IIS:
> http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
> bulletin/MS01-033.asp
>
> Deep analysis of worm:
>
> http://www.eeye.com/html/advisories/codered.zip
>
> I hope that helps.
>
> Chuck Schick
> Warp 8, Inc.
> www.warp8.com
> 303-421-5140
>
>
>
>
>
> ----- Original Message -----
> From: "Webmaster" <[EMAIL PROTECTED]>
> To: "Analog-Help@Lists. Isite. Net" <[EMAIL PROTECTED]>
> Sent: Friday, July 20, 2001 6:11 AM
> Subject: [analog-help] Problems , Maybe not related (urgent)
>
>
> : As I was configuring analog yesterday all of a sudden my server started
> : acting weird. I am running win 2000 with IIS 5.
> : NT AUTHORITY\SYSTEM keeps issuing start and stop commands to IIS.
> : Has any one seen this problem and could it be related to analog?
> :
> : Mark
> :
> :
> : +------------------------------------------------------------------------
> : | This is the analog-help mailing list. To unsubscribe from this
> : | mailing list, go to
> : | http://lists.isite.net/listgate/analog-help/unsubscribe.html
> : |
> : | List archives are available at
> : | http://www.mail-archive.com/[email protected]/
> : | http://lists.isite.net/listgate/analog-help/archives/
> : | http://www.tallylist.com/archives/index.cfm/mlist.7
> : +------------------------------------------------------------------------
> :
>
> +------------------------------------------------------------------------
> | This is the analog-help mailing list. To unsubscribe from this
> | mailing list, go to
> | http://lists.isite.net/listgate/analog-help/unsubscribe.html
> |
> | List archives are available at
> | http://www.mail-archive.com/[email protected]/
> | http://lists.isite.net/listgate/analog-help/archives/
> | http://www.tallylist.com/archives/index.cfm/mlist.7
> +------------------------------------------------------------------------
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
