The UK Home Automation Archive

Archive Home
Group Home
Search Archive


Advanced Search

The UKHA-ARCHIVE IS CEASING OPERATIONS 31 DEC 2024


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Re: IIS Worm


  • To: <ukha_d@xxxxxxx>
  • Subject: RE: Re: IIS Worm
  • From: "Keith Doxey" <ukha@xxxxxxx>
  • Date: Thu, 20 Sep 2001 22:14:00 +0100
  • Delivered-to: mailing list ukha_d@xxxxxxx
  • Mailing-list: list ukha_d@xxxxxxx; contact ukha_d-owner@xxxxxxx
  • Reply-to: ukha_d@xxxxxxx

Have you contacted the hosting ISP to see it they have put any blocking in
place.

One of the measures we took to stop the spread was to block port 80 which
disabled all HTTP thereby halting one means of spreading the worm. Servers
can still be pinged and FTP'd.

Maybe your ISP realised it was infected and shut it off from the net to try
to prevent other infections.

Just my 0.02

I really dont want to see another worm or virus like this bugger :-(

Keith


-----Original Message-----
From: Graham Howe [mailto:graham@xxxxxxx]
Sent: 20 September 2001 22:00
To: ukha_d@xxxxxxx
Subject: RE: [ukha_d] Re: IIS Worm


I actually managed to download all the patches at home and then transfer
them to the server. I also uninstalled IIS completely and removed all my
web
sites for off server 'cleaning'. I then copied a fresh version of the IIS
install files and reinstalled IIS. I also reinstalled SP6 and all the
patches. I have run find again for all files associated with the worm,
including searching in all files for readme.eml and the signature. I can
find nothing wrong. However the shares are still there (which is not really
concerning me too much) and web browsing is not working to or from the
server. This is extremely serious as this is my web server. As always, any
suggestions would be most welcome. Pinging by name and by IP address works
fine both too and from the server and I can browse the server from itself
by
both name and IP address.

Regards

Graham


For more information: http://www.automatedhome.co.uk
Post message: ukha_d@xxxxxxx
Subscribe:  ukha_d-subscribe@xxxxxxx
Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
List owner:  ukha_d-owner@xxxxxxx

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/


Home | Main Index | Thread Index

Comments to the Webmaster are always welcomed, please use this contact form . Note that as this site is a mailing list archive, the Webmaster has no control over the contents of the messages. Comments about message content should be directed to the relevant mailing list.