Virus Alert!

[Kraellin]

catiline, shiro, and all other admins,

i beg your indulgence on leaving this in GD for a couple days. you might even wanna double post it on other topics.

i was talking to my tech support guys at my isp today and it seems there is a new virus out. a number of friends have recently contacted me reporting slow service on this or that server, ftp's, stw multi, and some other stuff. i dont know if this is the reason for it or not, but the tech guys i was talking to today said that this new virus is attacking servers. it attaches to them apparently and then proceeds to flood itself and other servers with spam, thus overflowing and jamming various servers on the net.

it apparently does not attach itself to clients, just servers, so most of us here wont ever see it directly. you wont pick it up by going to an infected site either...or so my tech guys tell me. it seems to only be servers that are affected directly.

i have no other info on it than this. this is all they told me regarding it. i 'think' they mentioned that yahoo had been attacked by this thing, but they might have just been using yahoo as an example when they were telling me about it.

i'm sure there's more info out there about it, prolly on the major servers like yahoo or microsoft.com so you can go find out more about it if you like.

to the admins at the .org...you might wanna alert someone upstairs about this one...i've been lagging a lot on the .org lately so ya might wanna check this one out.

K.


------------------
I'm sorry, but i never apologize.

[Pussiecat]

aye - was on the news here in uk the other day - said it was attacking businesses mainly and leaving individuals pretty much well alone.

------------------

[Doragon_Ajidrik]

Is this the redworm virus?

------------------
We live in a world of Disclaimers

Honor to Clan Doragon
www.doragon.cjb.net (http://www.doragon.cjb.net)

[666HellSpawn]

Yeah I had that once. My doctor gave me some medicated talc...cleared it right up. http://www.totalwar.org/ubb/biggrin.gif

HellSpawn



------------------

[Murmandamus]

If you are referring to the Code Red worm and it's variants there is an excellent FAQ on this site http://incidents.org

Basically it exploits a security hole in IIS scripting capabilities .ida scripts mostly. There is a patch available from Microsoft and you can also help by disabling those scripts.

If you see something in your webserver logs along the lines of "GET default.ida?NNNNNNNN..." or something similar then that is the Code Red worm.

It will slow down all websites due to the increased net load due to it's propogation.

Hope this helps

[Muneyoshi]

All you have to do to get it off your computer is turn it off. Thats what it said on CNN anyways.

[Murmandamus]

Quote Originally posted by YagyuMuneyoshi:
All you have to do to get it off your computer is turn it off. Thats what it said on CNN anyways.[/QUOTE]


Rebooting is pointless. You have to patch the server or you will just get reinfected again. I run a webserver (Apache so I don't have to worry about this one) and it has been "probed" by the worm ~200 times in the last 24 hrs.

This worm propogates itself once it infects a server, so it will keep going around until everyone using IIS has patched their servers. The news broadcasters dumb down the information for the "Mums and Dads" viewers and in the process leave out the crucial information. A little knowledge is a dangerous thing.

------------------
Like a wooden man facing flowers and birds.

[CeltiberoSkullXIII]

OH MY GOD!!!

------------------
"It's better to let the enemy alive as to kill it ... To TORTURE it!" http://gifanimados.ya.com/terror/calaveras_banderas/flag_wht_blkbns_clr.gif

[HATAMOTOKILL]

worms,worms i hate them!eeeeeeeekkkkkkkkkk

------------------
Hato!!!
Knight Owltwwooo!!!
http://www.contrabandent.com/pez/contrib/legionxs/ninja1.gif