Toeng.com — Tue, 04 Sep 2001 19:11:30 +0000

mine's okay
but my brother's HD got wiped by SirCam

Mark Hensler — Tue, 28 Aug 2001 17:47:56 +0000

my linux logs had that stuff in their too... I had no idea what it was. thx

taff — Tue, 28 Aug 2001 17:41:34 +0000

Quote: Originally posted by mairving
It only affects Windows NT/2000 systems running MS II-s web server software. I would be very suprised if your system wasn't at least tested. Here is how to tell: if you can look in your error logs, you will see this:

[b]/../404.shtml
/../default.ida

That is Code Red. It was a known vulnerbility that MS offered a patch for quite awhile ago. [/B]

Truly annoying! All my sites are on Unix servers so there was never any real threat. However, my site logs are a mess! I've had to add a filter to remove all the *.ida requests.

As an example, one log file for Aug 1 - Aug 15 was 117 pages long (raw). After filtering, it was a mere 17 pages.

NSS — Fri, 17 Aug 2001 02:01:05 +0000

Many of us may have experienced the many virus types such as the CIH, melissa, ILOVEYOU, etc,

Perhaps the below link will help you to protect your systems against future attacks. It's not 100% but at least you are aware of the various types of virus that you may encounter and ways to avoid it.

http://www.cknow.com/vtutor/vttypes.htm

mairving — Tue, 14 Aug 2001 11:04:33 +0000

You guys are confusing things. The email was more than likely the Sircam virus. Code Red's method of delivery is not done through email. It's method of delivery is this: the infected host will attempt to connect to TCP port 80 of randomly chosen IP addresses in order to further propagate the worm. Depending on the configuration of the host that receives this request, there are varied consequences.

It only affects Windows NT/2000 systems running MS II-s web server software. I would be very suprised if your system wasn't at least tested. Here is how to tell: if you can look in your error logs, you will see this:

/../404.shtml
/../default.ida

That is Code Red. It was a known vulnerbility that MS offered a patch for quite awhile ago.

Sircam, though quite annoying, is relatively harmless as viruses go. There are some pretty nasty variants of it out there like this one that I was sent the other day:
W32.Magistr.24876@mm. Similar to Sircam but it's payload is pretty bad. I received mine in an email attachment. The email said something about running a marathon for diabetes. Here is what it does:

Large scale e-mailing: Uses email addresses from the Windows Address Book files and Outlook Express Sent Items folder.
Causes system instability: Overwrites hard drives, erases CMOS, flashes the BIOS.
Releases confidential info: It could send confidential Microsoft Word documents to others.

m0dulus — Tue, 14 Aug 2001 05:36:11 +0000

I got the email about 11 times - obviously i never open an unknown file

merlin — Tue, 14 Aug 2001 05:12:10 +0000

nope.

Brooke — Mon, 13 Aug 2001 23:07:24 +0000

I got the email about 3-4 times but it never got my machine.

Brooke

mjames — Mon, 13 Aug 2001 21:32:25 +0000

Me third.

The Webmistress — Mon, 13 Aug 2001 18:47:46 +0000

Me neither