Re: *** ADMIN: Downtime 8/6

it is sadly funny that MS's own windowsupdate.com servers were infected
http://archives.neohapsis.com/archives/bugtraq/2001-07/0410.html
this worm ain't done yet.
has anyone thought of writing a pgm to read the logfile, do a whois on the
ip,
get the contact email & notify the server owner. I have no idea how,
but the concept seems possible. I'm getting about 100 attempts to infect a
day.
jim

----- Original Message -----
From: "Sean Porterfield" <sporter@bestdist.com>
To: <MIDRANGE-L@midrange.com>
Sent: Tuesday, August 07, 2001 5:26 PM
Subject: RE: *** ADMIN: Downtime 8/6


> The worm opens the server running IIS and can then be controlled or
crashed
> at will.  Microsoft isn't SOLELY to blame, though, someone had to WRITE
the
> worm.
>
> >-----Original Message-----
> >From: Leif Svalgaard
> >>From: Lou Forlini <lforlini@sspi-software.com>
> >
> >> At 9:08 AM -0500 8/7/01, Leif Svalgaard wrote:
> >> >interesting how everybody (the media, at least) blame Micro$oft ISS
for
> >code
> >> >red,
> >> >when Cisco is also to blame.
> >>
> >>     Microsoft is solely to blame.  The fact that Cisco routers crash
> >> because of the worm is a bug in Cisco's code, but does not cause the
> >> worm to propagate.  Some web servers (not IIS) also crash when they
> >> receive the extra long URL request, but do not propagate the worm.
> >>
> >
> >so now we blame Micro$oft for NOT crashing like the others.  :-)
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---