[thelist] another worm?

[Shirley Kaiser, SKDesigns]

Isaac,

My ISP's IIS servers got nailed this morning. It sound like he's 
potentially out a chunk of money, too? I don't know much at all about 
servers. I know he's got all the data backed up in at least 2 other 
locations, which gets backed up a lot. Seems like that would save him on 
this, but I don't know.

I can't even imagine what my ISP is faced with today. I'm sure he's not a 
happy camper right about now.

<sigh> This really stinks, to be polite about it. ;-)  I've got these 
posted at my web log, which isn't online so I'll go ahead and post them 
here -- some sites with info about this:

W32.Nimda.A at mm
http://www.sarc.com/avcenter/venc/data/w32.nimda.a@mm.html
[09/18/01  12:38:50 PM PDT, Symantec]

FBI investigating new Internet worm
http://www.cnn.com/2001/TECH/internet/09/18/internet.attack.ap/index.html
  [09/18/01 9:05 PM EDT (0105 GMT),  Associated Press]

New Computer Worm Hits Both Servers and PCs
http://dailynews.yahoo.com/h/nm/20010918/tc/tech_worm_dc_2.html
[09/18/01 updated 8:22 PM EDT, Reuters]

Lethal worm spells double trouble
http://dailynews.yahoo.com/h/zd/20010918/tc/lethal_worm_spells_double_trouble_1.html
[09/18/01 02:15 PM EDT, By Robert Lemos, ZDNet News]


Warmly,
Shirley
--
Shirley E. Kaiser, M.A.
SKDesigns  mailto:skaiser1 at skdesigns.com
Website Development  http://www.skdesigns.com/
Pianist, Composer  http://www.shirleykaiser.com/
Moderator, I-Design http://www.adventive.com/lists/idesign/summary.html


At 04:51 PM 09/18/2001, isaac wrote:

>If you have IIS running on any net-accessible machine somewhere, even if you
>don't care about it getting hacked, lock it down. We had a gateway machine
>running IIS that we weren't too worried about. Then code red did $800 worth
>of data transfer (data costs are very high in Australia - 18-25c/MB) on our
>ADSL connection. Telstra (primary telco here in Australia) nicely refunded
>30+% of that despite being under no obligation to do so.
>
>Unless you have money to burn, lock down your machine. If you have money to
>burn, pay someone else to secure it for you.
>
>Microsoft released some kind of lockdown tool which is quick to download,
>ultra-easy to run, and (from memory) doesn't require any rebooting of the
>machine. I'm sure the URL is available somewhere on their site.
>
>
>isaac
>
>--------------------------------------------------------------
>triple zero digital | upstairs at 200 the parade, norwood 5067
>(08)83320545 | www.triplezero.com.au | isaac at triplezero.com.au