[thelist] another worm?

Norman Bunn norman.bunn at mindspring.com
Tue Sep 18 12:56:57 CDT 2001

One of my sites is being hammered with something trying to execute
Windows-type programs via the browser.  Since I capture 404s, I am seeing
all this activity.  Fortunately, this machine is running Linux, not Windows.
The attack is coming from multiple domains and is trying what appear to be
common directories for the Windows executables.

Strings I am seeing are:





It looks like someone is trying to exploit the IIS Remote Execution
Vulnerability or something similar.

Anyone else seeing this?


> ok, a few of our clients were hit this morning by something that
> tries to get your browser (on windows) to download a .eml file
> which it would then launch via an .exe...
> i can't get to any virus sites, since all web traffic coming and going
> is pretty hosed right now...

More information about the thelist mailing list