Re: Usenet weather phenomenon - the worm and the fool

From: Bit Twister (BitTwister_at_localhost.localdomain)
Date: 08/13/03 

Date: Wed, 13 Aug 2003 16:18:09 GMT

On Wed, 13 Aug 2003 18:52:41 +0300, toro wrote:
> Isn't this beautiful ?
>
> O.K. so I've also flamed this delusional whacko in the past like other
> people do. I've also made fun of this person's writings when I should
> ignore them instead.

Yes, I think she has managed to cause this group to degade to almost
usless.

If everyone would start reporting her spam to yahoo and her ISP
maybe the problem will go away, at least for awhile.

I've stopped though, and I think it's one easy
> thing to do. Is it so hard to stop feeding the seasonal trolls ? One
> warning should be enough, there's really no need for additional
> comments, corrections or remarks.
>
> I am bringing this up out of respect to people like Don, Jim, Lord
> Shaolin and a few others who are the reasons I lurk here. In an
> attempt to raise the level of the group a little bit, what do you
> think of the worm so far ? What are your experiences for the past few
> days ? Do you think the net was more prepared this time or M$ lost
> more customers with this ?

So far I like the worm.

I believe the worm is malformed. After a while it crashes the box.
I saw a TV report where one shop had 150 boxes brought in yesterday.

I had see my firewall decease to nothing. I went back in and enabled
logging on the ports just to verify it was working.

Since 1am only had about 5 hits.

I had see the hits weeks ago and had quit logging the ports.
Last week or so I'm getting hits on port 1026
nterm 1026/tcp # remote_login network_terminal

Saw a post where the zombies were to hit the Micro$oft update site
in a few days but someone indicated the update already went toes up
by users trying to get the update.

Relevant Pages

  • Re: UDP Ports, closing Win2K Server (No IIS)
    ... What's listening on UDP 995? ... The worm spreads via email but some antivirus vendors report ... against using IPSec as a firewall, and blocking just one or two ports here ...
    (microsoft.public.inetserver.iis.security)
  • Re: New program/virus is making the rounds?
    ... >Most hits were port 27374, now almost all are port 1433. ... affected by this worm. ... administrator privileges. ...
    (comp.security.firewalls)
  • Re: New program/virus is making the rounds?
    ... >Most hits were port 27374, now almost all are port 1433. ... affected by this worm. ... administrator privileges. ...
    (comp.security.firewalls)
  • Re: Question: excessive pinging by the same IP
    ... If it is the same range of ports on a somewhat "regularly scheduled ... interval" than it is usually a worm or an automated script. ... find the peace and quiet it will afford you from such alerts quite ...
    (comp.security.firewalls)
  • Re: ICF and File Sharing
    ... Those ports are the critical ones and should not be opened without any valid reason. ... Windows XP Shell ... What You Should Know About the Sasser Worm and It Variants: ...
    (microsoft.public.windowsxp.general)
Quantcast