--WebTV-Mail-6126-2233 Content-Type: Text/Plain; Charset=US-ASCII Content-Transfer-Encoding: 7Bit i thought i should pass this on kathy Researching; DOUGHERTY, MACDONALD, BAER, BRENNAN, MCLAUGHLIN, GORDON, SHEPHARD, RENZ, VOLLMER (FULLMER), SCHUMACHER (SHOEMAKER), PASZOTTA, SHUTT Places; Ireland, Germany, Ohio, Pennsylvania, Indiana, Delaware --WebTV-Mail-6126-2233 Content-Disposition: Inline Content-Type: Message/RFC822 Content-Transfer-Encoding: 7Bit Received: from smtpin-101-9.bryant.webtv.net (209.240.198.149) by storefull-141.iap.bryant.webtv.net with WTV-SMTP; Tue, 18 Sep 2001 17:54:07 -0700 (PDT) Received: by smtpin-101-9.bryant.webtv.net (WebTV_Postfix+sws) id 013AA158; Tue, 18 Sep 2001 17:54:07 -0700 (PDT) Delivered-To: [email protected] Received: from lists2.rootsweb.com (lists2.rootsweb.com [63.92.80.32]) by smtpin-101-9.bryant.webtv.net (WebTV_Postfix+sws) with ESMTP id A717719E for <[email protected]>; Tue, 18 Sep 2001 17:54:06 -0700 (PDT) Received: (from [email protected]) by lists2.rootsweb.com (8.10.1/8.10.1) id f8J0s6110910; Tue, 18 Sep 2001 18:54:06 -0600 Resent-Date: Tue, 18 Sep 2001 18:54:06 -0600 X-Original-Sender: [email protected] Tue Sep 18 18:54:06 2001 Delivered-To: [email protected]@fixme Reply-To: <[email protected]> From: "John A Hansen" <[email protected]> Old-Cc: "John A Hansen" <[email protected]> Subject: FW: New "concept" virus/worm = Nimba Date: Tue, 18 Sep 2001 17:51:22 -0700 Message-ID: <[email protected]> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal Resent-Message-ID: <[email protected]> To: [email protected] Resent-From: [email protected] X-Mailing-List: <[email protected]> archive/latest/4 X-Loop: [email protected] Precedence: list Resent-Sender: [email protected] Dear All: This is the next step in Virus activity as previously described. Note that this virus infects even the user who does NOT open the attachment, but merely opens the basic email in a preview pane or otherwise even tries to read the basic email itself. So those that depend on their virus protection as being "don't open attachments" are going to get caught here. Also recognize that this virus is far worse that SirCam etc etc. I've also seen warning of the next mutant of this being a really dangerous payload. It was also self mutate. Best Regards John A Hansen [email protected] List Admin -----Original Message----- From: Peter Mueller [mailto:[email protected]] Sent: Tuesday, September 18, 2001 1:42 PM To: Incidents List Cc: Vuln Dev Subject: RE: New "concept" virus/worm? http://www.microsoft.com/windows/ie/download/critical/Q290108/default.asp <exerp from securityfocus> Experts are tracking a fast-spreading virus that propagates both by sending itself as an email attachment, and by hacking into vulnerable web servers. The [email protected] worm infects IIS servers by exploiting the 'MS IIS/PWS Escaped Characters Decoding Command Execution Vulnerability' -- the same hole exploited by the recent Code Blue worm. The worm also attacks Microsoft Outlook users, arriving as an apparently blank message with an attachment called 'readme.exe.' As with other viruses, opening the attachment will infect the machine. But unlike most so-called mass mailers, Nimda can also infect Outlook and Outlook Express users who know better than to open strange attachments. By exploiting a bug in Internet Explorer discovered last March, the worm is able to infect victim computers when the email is read, or even displayed in Outlook's preview pane. A patch for the 'Microsoft IE MIME Header Attachment Execution Vulnerability' is available from Microsoft's web site. Once it has infected a machine, Nimda exposes local hard drives to the network, and spreads further through already-open file shares. Cyber security mailing lists began buzzing with word of the [email protected] worm Tuesday morning, after network administrators noticed a massive increase in probes for unpatched Microsoft's IIS web server software. No destructive payload was immediately identified in the worm, but network administrators report that the worm consumes massive amounts of bandwidth in its feverish search for vulnerable servers. The virus comes at a time of heightened sensitivity to Internet attack. On Monday the U.S. National Infrastructure Protection Center (NIPC) issued an advisory warning that a group of vigilante hackers called 'The Dispatchers' have threatened to launch distributed denial of service attacks against unnamed Internet hosts, in response to the September 11th terrorist attacks on the United States. "The Dispatchers claim to have over 1,000 machines under their control for the attacks," the advisory reads. "It is likely that the attackers will mask their operations by using the IP addresses and pirated systems of uninvolved third parties." ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ============================== Shop Ancestry - Everything you need to Discover, Preserve & Celebrate your heritage! http://shop.myfamily.com/ancestrycatalog --WebTV-Mail-6126-2233--