[Date Prev][Date
Next][Thread Prev][Thread Next][Date
Index][Thread Index]
Re: IIS worm infection
- To: ukha_d@xxxxxxx
- Subject: Re: IIS worm infection
- From: Ian Oliver <ioliver.lists@xxxxxxx>
- Date: Thu, 20 Sep 2001 16:01:57 +0100
- Delivered-to: mailing list ukha_d@xxxxxxx
- Mailing-list: list ukha_d@xxxxxxx; contact
ukha_d-owner@xxxxxxx
- Reply-to: ukha_d@xxxxxxx
In article <000c01c14086$e89b4610$2701a8c0@ec2a1nl9103840>, Graham
Howe
wrote:
> OK, it is bad, over 4500 files on my server have been modified today.
Note that there are reports that even files not seeming to be modified
may have been. The virus seems to create a new file, copy across the
contents, delete the original, set time/date on new to same as old and
then rename it. This is probably to let access rights be changed under
NTFS. I'd check file owners and access rights if I were you.
Regards
Ian Oliver
Sunny Leeds, UK
Using Java on Tini for control via Dallas 1-wire
For more information: http://www.automatedhome.co.uk
Post message: ukha_d@xxxxxxx
Subscribe: ukha_d-subscribe@xxxxxxx
Unsubscribe: ukha_d-unsubscribe@xxxxxxx
List owner: ukha_d-owner@xxxxxxx
Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Home |
Main Index |
Thread Index
|