On or about 06:18 PM 2/8/01 -0700, Sean Reifschneider was caught in a dark
alley speaking these words:
>On Thu, Feb 08, 2001 at 05:02:06PM -0800, Aaron L. Meehan wrote:
>>I'm pretty sure this is the work of the W95.Hybrid email worm (the
>>sexyfun.net one), sending copies of itself to the mail2news gateway
>
>What triggered the sudden hit then? sexyfun has been around for
>quite a while and the mail servers have kept up pretty well. This
>one is really pounding it though.
I think part of it's ability to download updates makes changes to the worm,
to the point where you may be seeing a new variant of it. I've seen *2*
variants of this so far - one from "sexyfun" and the badly misspelled
story, and one with no story or faked sender - only an empty sender, but
otherwise the same virus.
This critter hasn't taken down our qmail server (mark 1 for the good guys)
despite it's being an antique (relatively speaking) - Cyrix P166(ish) / 4G
IDE / 128M RAM, altho I was receiving nearly 1000 double-bounces per day
from the damnable thing. Tracking who has it isn't exactly easy, either...
however if there are any dial-up sysadmins out there who could use a tip,
this has helped me out considerably:
In Win9x, under the network control panel, setting the "Host:" setting
under DNS to the username of the person, will make that username show up in
the (HELO xxxxx) string in qmail's main Received: header. We had our
customers set this since day 1, and this has helped me immensely in
tracking the infected person.
That and if you have separate qmail & authentication servers, make sure
they're both updated at least once per day to an atomic time clock. Servers
that are 5 min. off are a real bugger to figure out who was online when...
Anywho, I hope this helps someone out there -- it's the least I can do to
try to repay the help I've received on this list over the last 6 years... :-)
Thanks,
Roger "Merch" Merchberger
=====
Roger "Merch" Merchberger -- [EMAIL PROTECTED]
SysAdmin - Iceberg Computers
===== Merch's Wild Wisdom of the Moment: =====
Sometimes you know, you just don't know sometimes, you know?
