RE: Re: IIS Worm

[pmiller@xxxxxxx]

Have you checked to see if IE is trying to go via a non functioning proxy?





"Graham Howe"
<graham@solar        To:     <ukha_d@xxxxxxx>
fish.com>            cc:
Subject:     RE: [ukha_d] Re: IIS Worm
19/09/2001
15:46
Please
respond to
ukha_d






Correction to problem 2 below. I CAN ping from my server to another site
both by IP address and name, so the my ISPs gateway and DNS must be
correctly set up. However I can not browse from Internet Explorer to
anywhere. I have now uninstalled IE6, but I have the same problem with the
previous version (IE5.5). I can't run the connection wizard as it has some
missing files but to be honest there shouldn't be a need to do so as I am
connecting through my ISPs LAN.

Any suggestion would be most welcome.

Graham

> -----Original Message-----
> From: Graham Howe [mailto:graham@xxxxxxx]
> Sent: 19 September 2001 14:18
> To: ukha_d@xxxxxxx
> Subject: RE: [ukha_d] Re: IIS Worm
>
>
> OK guys, thanks for all the assistance, it looks like I have made some
> progress now.
>
> All patches are applied to the server, the MS Code Red tool
> has removed any
> suspicious programs (as have I). All files have been cleaned
> (a FIND across
> all drives reports no instance of readme.eml inside any file). I have
> upgraded to IE6.
>
> However there are two problems:
> 1. When I reboot the server it still shares all my drives yet
> a search of
> system.ini shows no mention of the -dontrunold bit. So I
> assume that the
> worm is gone from the system but it has done something in the
> registry that
> keeps being applied at start up. Does anyone know what this might be?
>
> 2. For some reason I can not browse from my server to the
> internet (yet I
> could last night as I was downloading IE6). I can connect to
> my server using
> pcAnywhere and it seems to have IP running correctly, but I
> can not ping
> from my server to any internet site. I'm not sure that this
> is anything to
> do with the worm, but it seems like there might be some
> problem with the
> network settings on the server. The server is physically located in
> Manchester at my ISP so I am a little concerned about mucking
> about with
> network settings that could end up preventing me from
> remotely accessing the
> box. Again does anyone have any ideas?
>
> Regards
>
> Graham
>
>
> ------------------------ Yahoo! Groups Sponsor
> ---------------------~-->
> Get your FREE credit report with a FREE CreditCheck
> Monitoring Service trial
> http://us.click.yahoo.com/MDsVHB/bQ8CAA/ySSFAA/IBOolB/TM
> --------------------------------------------------------------
> -------~->
>
> For more information: http://www.automatedhome.co.uk
> Post message: ukha_d@xxxxxxx
> Subscribe:  ukha_d-subscribe@xxxxxxx
> Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
> List owner:  ukha_d-owner@xxxxxxx
>
> Your use of Yahoo! Groups is subject to
http://docs.yahoo.com/info/terms/





For more information: http://www.automatedhome.co.uk
Post message: ukha_d@xxxxxxx
Subscribe:  ukha_d-subscribe@xxxxxxx
Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
List owner:  ukha_d-owner@xxxxxxx

Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.