ALERT -- New IIS worm!! 1

[rycamor]

Check out

http://slashdot.org/article.pl?sid=01/09/18/151203

Apparenty this one is worse than Code Red. My Apache box has already had over 1000 attempts since this morning, and this is just my DSL firewall at home.

It infects IIS servers, and then does two things:
1) sends GET requests to infect other machines in the IP block
2) attaches a "readme.eml" file to every document server, which usually gets automatically executed by IE5+, thereby writing some changes to the registry, and emailing some registry information elsewhere.

DON'T browse with IE right now, Get Netscape, Mozilla, or Opera, please.

Check your server logs for requests including "cmd.exe", "root.exe", and "admin.dll".

 

[DSect]

Here are some good site with valid info relating to the Nimda: W32.nimda.a.mm worm

http://www.trusecure.com

http://www.eeye.com

Check them out - Look for my thread in thr NT4 forum and you will see some of the preliminary findings of what it does.