Fw: <hopper-ex> Fwd: Warning: New Microsoft Worm

[Kurt Cagle <kurt@kurtcagle.net>]

Here we go again ... Time to get that Linux port done.

-- Kurt
----- Original Message -----
From: "Thomas W.J.C. McCrystal" <tmc@creative-perspectives.com>
To: "Multiple recipients of hopper-ex" <hopper-ex@moshplant.com>
Sent: Tuesday, September 18, 2001 10:01 AM
Subject: <hopper-ex> Fwd: Warning: New Microsoft Worm


> For those of you running various flavors of Windows, I thought I'd
> forward this. There's a lot more info on slashdot, as well.
>
> (I'm seeing a bunch of failed connection attempts into my Shockwave
> Multiuser Servers rught now, but nothing like the 500 - 1000 per hour
> some people here are reporting on their DSL.)
>
> Tom McCrystal
>
> ---------------- Begin Forwarded Message ----------------
> Date:        9/18/01 11:59 AM
> Received:    9/18/01 12:06 PM
> From:        Waldo Jaquith, waldo@waldo.net
> Reply-To:    Neon Guild Mailing List, members@neonguild.org
> To:          Neon Guild Mailing List, members@neonguild.org
>
> Folks,
>
> This is the third time, in a decade of Internet usage, that I've ever used
> the priority flag when sending e-mail.  So it really means something. :)
>
> There is a new Microsoft worm going around.  It started at approximately
> 8:30am this morning, and we're already hard at work tracing its origin.
> It
> attempts to exploit dozens of holes, meaning that if you have an NT or
> 2000
> machine, you likely have one of these holes.  Upon encountering one of
> them,
> it infects your machine (a la Code Red) so that it will, in turn, infect
> others.  If you open up one of these infected machines via Internet
> Explorer
> (ie, by entering any of the below addresses) on Window, it will transfer a
> "readme.eml" to your machine (Windows 96, 98, ME, XP, whatever), which
> will
> promptly be infected.  (The payload of that virus is still unknown.)  Yes,
> that's right, this worm carries a virus.
>
> No doubt the mainstream media will pick up on this soon and offer better
> advice than I can.  The only coverage right now is at
> <http://slashdot.org/article.pl?sid=01/09/18/151203&mode=thread>. Right
> now,
> I advise the following:
>
> 1. Remove all unnecessary Windows machines from your Internet connection.
> 2. Check your logs for worm activity.  (It should be obvious in your web
> logs.)
> 3. Patch your systems.
> 4. Spread the word.
> 5. Install Linux or BSD.
>
> (No doubt some people will argue with #5, but I did it in 1994, and I
> haven't had a worm or virus concern since!)
>
> Finally, the public flogging.  The following local machines are infected:
>
> frdrake.cfw.com
> saic19.cv.mvl.intelos.net
> brainstorm1.win.mvl.intelos.net
> saic19.cv.mvl.intelos.net
> terralogic3.stn.mvl.intelos.net
> brainstorm1.win.mvl.intelos.net
> saic19.cv.mvl.intelos.net
> c4s11m8.access.ntelos.net
> saic19.cv.mvl.intelos.net
> c4s11m8.access.ntelos.net
>
> If you are any of these, or you know the owner of any of these, please
> contact them and let them know of their infection.  SAIC, whoever you are,
> I'm sick of your lack of security -- your machine has been bombarding
> everybody's here in town with Code Red, Code Red II, and now this unnamed
> worm.  Get with it.  Install Linux.
>
> Best,
> Waldo
>
> #############################################################
> This message is sent to you because you are subscribed to
>   the mailing list <members@neonguild.org>.
> To unsubscribe, E-mail to: <members-off@neonguild.org>
> Send administrative queries to  <members-request@neonguild.org>
>
> ----------------- End Forwarded Message -----------------
>