We are hit too

[Normand Dionne]

Title: serious network down...readme.eml??

We found two servers out of the many on our campus that was been hit at about 3am HST. Most attacks are failing on the servers, but those infected don't seem to have a away to stop this process.

 

We too have seen the thousands of alien files.

 

Note that we saw an extra entry on every html file on the infected servers which called some mail script.

 

Mahalo,

 

Normand Dionne
UH Hilo
Academic Computing Services
808-974-7768 (Voice and FAX)

-----Original Message-----
From: Terry Manolakos [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, September 18, 2001 6:21 AM
To: NT System Admin Issues
Subject: serious network down...readme.eml??

My network is slammed with some uknown virus of some sort.....Both my NT 4.0 servers running MS-Exchange 6.5 have about 2300 alien files which were deleted....a "readme.eml" is being executed by all users somehow automtically and its infecting all my NT domain.   I can not Ctrl+Alt+Delete to log into any of the servers.....the display shows "initialization of the dynamic link library C:\WINNT\system32\USER32.dll failed. The process is terminating abnormally"  OKaying this results in no effects....all servers have this displayed onscreen.  For the ones that have admin already logged in, Services (control panel, settings) can not be accessed!  "access to the specified device, path, or file is denied"....it seems this virus has locked onto this element.  PDC is running Exchange (I know, never put'em together...but we're still cleaning up after previous SysAdmins here), and this has gone bezerk as well, with the same message onscreen.  Norton/Symantec doesn't recognize "readme.eml"....who out there can shine a flashlite in this dark mess?  thanks in advance.

Terry 

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm