PSN-L Email List Message

Subject: Virus alert - I got hit
From: "Larry Cochrane" cochrane@..............
Date: Wed, 19 Sep 2001 20:47:12 -0700


All,

As I'm sure most of you know there is a new virus / worm going around called
Nimda Worm. Unfortunately my NT Server got infected with this worm causing
lots of problems. My system has been off-line for over 24 hours now as I try
and remove the worm from the system. Currently my Web server is turned off.
I will be turning it back on again in a few minutes. Hopefully the system
won't get re infected as the source of infection was Microsoft's Web server.
I did not run any programs. This one automatically ran because M$'s Web
server had a hole in it that could be exploited and used to run a program
that the worm uploads to the server. The program then spreads the worm to
the system etc. It modified all of my html pages by placing a little Java
Script at the end of each file and corrupted a lot of other files. User
accessing my PSN site would be asked if they want to download a file called
"readme.exe". If the user did download it and ran the program, the worm
would spread again.

For more information on the nasty worm see
http://www.cert.org/advisories/CA-2001-26.html.

I have installed all of the hotfixes from Micro$oft so hopefully this worm
won't effect my system again.

Regards,
Larry Cochrane
Redwood City, PSN





__________________________________________________________

Public Seismic Network Mailing List (PSN-L)


[ Top ] [ Back ] [ Home Page ]

Larry Cochrane <cochrane@..............>