RE: Re: IIS Worm

["Keith Doxey" <ukha@xxxxxxx>]

Have you contacted the hosting ISP to see it they have put any blocking in
place.

One of the measures we took to stop the spread was to block port 80 which
disabled all HTTP thereby halting one means of spreading the worm. Servers
can still be pinged and FTP'd.

Maybe your ISP realised it was infected and shut it off from the net to try
to prevent other infections.

Just my 0.02

I really dont want to see another worm or virus like this bugger :-(

Keith


-----Original Message-----
From: Graham Howe [mailto:graham@xxxxxxx]
Sent: 20 September 2001 22:00
To: ukha_d@xxxxxxx
Subject: RE: [ukha_d] Re: IIS Worm


I actually managed to download all the patches at home and then transfer
them to the server. I also uninstalled IIS completely and removed all my
web
sites for off server 'cleaning'. I then copied a fresh version of the IIS
install files and reinstalled IIS. I also reinstalled SP6 and all the
patches. I have run find again for all files associated with the worm,
including searching in all files for readme.eml and the signature. I can
find nothing wrong. However the shares are still there (which is not really
concerning me too much) and web browsing is not working to or from the
server. This is extremely serious as this is my web server. As always, any
suggestions would be most welcome. Pinging by name and by IP address works
fine both too and from the server and I can browse the server from itself
by
both name and IP address.

Regards

Graham


For more information: http://www.automatedhome.co.uk
Post message: ukha_d@xxxxxxx
Subscribe:  ukha_d-subscribe@xxxxxxx
Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
List owner:  ukha_d-owner@xxxxxxx

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/