Re: nimda tries to send mail after reboot

From: Brett Glass (brett@lariat.org)
Date: 09/19/01 

Message-Id: <4.3.2.7.2.20010919110944.05950520@localhost>
Date: Wed, 19 Sep 2001 11:13:30 -0600
To: jforster@rapidnet.com
From: Brett Glass <brett@lariat.org>
Subject: Re: nimda tries to send mail after reboot

Messages bearing the worm are starting to trickle in, slowly. It
may be that the worm is designed to start e-mailing only after the
infection is a certain number of hours old.

Sadly, the copies of the worm we're receiving are coming from
companies whose employees we'd expect to know better than to
leave machines unprotected -- such as V-One and SCO.

I agree that it will be a very long week. None of our machines
is susceptible to the worm, but our backbone feed is getting
hammered. I wish we had a firewall under our control at our
upstream provider.

--Brett Glass

At 11:08 AM 9/19/2001, jforster@rapidnet.com wrote:

>I got a few copies of this worm (via e-mail) this afternoon.
>Sadly, someone else in the office did as well (or hit an infected site).
>It's going to be a long week....

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: RPC security error is restarting my comp
    ... or reboot, quickly go to: ... > Is the original problem actually the worm which I have ... >>install the patch mentioned above. ... >>It is suggested that you first download the patch to your ...
    (microsoft.public.windowsxp.security_admin)
  • Re: security advice (possible hacker activity?)
    ... Launching CMD.EXE from IIS is a common hacker ... > are being scanned by worm that is not related to the lockups]. ... > sap resources and reboot computers, or it could be a general software ...
    (microsoft.public.inetserver.iis.security)
  • Re: security advice (possible hacker activity?)
    ... Launching CMD.EXE from IIS is a common hacker ... > are being scanned by worm that is not related to the lockups]. ... > sap resources and reboot computers, or it could be a general software ...
    (microsoft.public.win2000.security)
  • Re: Computer Question/Trouble Shooting -Need 2nd Opinion. Help me help the needy.
    ... or what kind of worm, or even if there was a worm for sure. ... At some point either before or after the reboot, ... Occasionally I'll get the "OS Not Found" error message. ... Boot to command prompt. ...
    (alt.comp.hardware.pc-homebuilt)
  • Computer Question/Trouble Shooting -Need 2nd Opinion. Help me help the needy.
    ... or what kind of worm, or even if there was a worm for sure. ... At some point either before or after the reboot, ... Occasionally I'll get the "OS Not Found" error message. ... Boot to command prompt. ...
    (alt.comp.hardware.pc-homebuilt)
Quantcast