RE: IIS Worm

["Mark Hetherington \(egroups\)" <mark.egroups@xxxxxxx>]

The "attacks" against me were futile. It is merely the worm on
compromised
systems attacking neighbouring IP ranges. My firewall stealth blocks
anything I ask it to, so I know my system remains secure and for the time
being at least my entire http serving capabilities are stealthed to prevent
me being asked about access all the time. I will eventually reopen specific
trusted IP addresses or ranges but for now, I am not concerned that my
system is "offline" to the world.

I also understand why the net is so laggy tonight with all these systems
almost DOS attacking large portions of the net.

I like IIS since I use ASP for a number of tasks. Plus I know IIS and if I
were to change it would likely to be to Apache since I am familiar with
that
environment. (I have a Linux machine dedicated to it for development at the
moment)

I am not familiar with Lotus Notes web serving capabilities, but I suspect
that it's lack of presence on the web is the sole reason it has yet to be
exploited and without meaning any offence to satisfied customers, would not
want to put myself in the position of testing the world wide water with it
:)

Mark.

> -----Original Message-----
> From: Gareth Cook/STA/Lotus [mailto:gcook@xxxxxxx]
> Sent: 18 September 2001 23:05
> To: ukha_d@xxxxxxx
> Subject: RE: [ukha_d] IIS Worm
>
>
> Try getting a copy of Lotus Notes - great product - viri free (been
going
> since 1989), and a damn good web server - very powerful - full ICE,
> webserver, and development environment. And now with IBM, strong
> links into
> DB2 and other RDBS
>
> Plug over (!)
>
> G.
> --------------+---------------------+----------------------+-----
> -------------------
>    (Embedded   Gareth Cook          Office:  +44 (0) 1784
>  Work: g@xxxxxxx
>   image moved  Senior Engineering          445 166
>           Personal:
>    to file:    Specialist           Mobile:  +44 (0) 7980
>    g@xxxxxxx
>  pic11020.jpg) EMEA ED, IBM SWG            445 166
>  AIM Chat : TheBoyG
>                Lotus Park, Staines,   Fax:      +44 (0)
>
>                TW18 3AG                 1784 499 166
>
> --------------+---------------------+----------------------+-----
> -------------------
>
>
>
> ----- Forwarded by Gareth Cook/STA/Lotus on 18/09/2001 23:03 -----
>
>
>        Discussion       .
>
>        Main Topic
>
>                         Subject:
>
>      "Graham Howe"      .
>
>  <graham@xxxxxxx>            RE: [ukha_d] IIS Worm
>
>       Today 21:32                  .
>
>                         Category:
>
>
>
>
>
>
>
>
>
>
> ----------------------+-------------------------------------------
-------------------------------------------
>
>
>
> My server has been hit, any idead what to do about it?
>
> Graham
>
> > -----Original Message-----
> > From: Mark Hetherington (egroups)
> > [mailto:mark.egroups@xxxxxxx]
> > Sent: 18 September 2001 21:02
> > To: ukha_d@xxxxxxx
> > Subject: RE: [ukha_d] IIS Worm
> >
> >
> > A seemingly very prolific one it seems given the huge number of
http
> > requests my PC is getting. (There is a web server there but
> > no tpublished
> > and nothing on it) Getting 4+ attempts per incoming IP so
> > seems likely to be
> > the worm. I have been getting them for a while now but
> > tonight has been
> > almost constant since logon.
> >
> > My Norton Internet Security installation has never been so busy
:)
> >
> > Mark.
> >
> > > -----Original Message-----
> > > From: Broadfoot, Kieran J [mailto:Kieran.Broadfoot@xxxxxxx]
> > > Sent: 18 September 2001 17:40
> > > To: 'ukha_d@xxxxxxx'
> > > Subject: [ukha_d] IIS Worm
> > >
> > >
> > >
> > > Those of you who need to concern yourselves with these
> > kinds of things
> > > probably know but for those who dont you might want to shut
> > down your IIS
> > > servers if you are directly connected to the web right now
> > (w32.nimda.amm)
> > >
> > > There is a rather nasty new worm out and about on a pipe
near you.
> > >
> > > http://slashdot.org/articles/01/09/18/151203.shtml
> > >
> > > Thanks
> > >        kieran
> > >
> > > For more information: http://www.automatedhome.co.uk
> > > Post message: ukha_d@xxxxxxx
> > > Subscribe:  ukha_d-subscribe@xxxxxxx
> > > Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
> > > List owner:  ukha_d-owner@xxxxxxx
> > >
> > > Your use of Yahoo! Groups is subject to
> > http://docs.yahoo.com/info/terms/
> > >
> > >
> > >
> >
> >
> > For more information: http://www.automatedhome.co.uk
> > Post message: ukha_d@xxxxxxx
> > Subscribe:  ukha_d-subscribe@xxxxxxx
> > Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
> > List owner:  ukha_d-owner@xxxxxxx
> >
> > Your use of Yahoo! Groups is subject to
> > http://docs.yahoo.com/info/terms/
> >
> >
> >
> >
>
>
> For more information: http://www.automatedhome.co.uk
> Post message: ukha_d@xxxxxxx
> Subscribe:  ukha_d-subscribe@xxxxxxx
> Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
> List owner:  ukha_d-owner@xxxxxxx
>
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
>
>
>
>
> For more information: http://www.automatedhome.co.uk
> Post message: ukha_d@xxxxxxx
> Subscribe:  ukha_d-subscribe@xxxxxxx
> Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
> List owner:  ukha_d-owner@xxxxxxx
>
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
>
>


For more information: http://www.automatedhome.co.uk
Post message: ukha_d@xxxxxxx
Subscribe:  ukha_d-subscribe@xxxxxxx
Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
List owner:  ukha_d-owner@xxxxxxx

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/