From owner-freebsd-isp Tue Sep 18 13:40:17 2001 Delivered-To: freebsd-isp@freebsd.org Received: from buffnet4.buffnet.net (buffnet4.buffnet.net [205.246.19.13]) by hub.freebsd.org (Postfix) with ESMTP id 0289D37B40E for ; Tue, 18 Sep 2001 13:40:11 -0700 (PDT) Received: from buffnet11.buffnet.net (buffnet11.buffnet.net [205.246.19.55]) by buffnet4.buffnet.net (8.9.3/8.8.7) with ESMTP id QAA99772; Tue, 18 Sep 2001 16:45:10 -0400 (EDT) (envelope-from shovey@buffnet.net) Date: Tue, 18 Sep 2001 16:39:30 -0400 (EDT) From: Stephen Hovey To: bv@wjv.com Cc: "Gary D. Margiotta" , Paul Boehmer , freebsd-isp@FreeBSD.ORG Subject: Re: Code Red?! In-Reply-To: <20010918144344.B18054@wjv.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org I got an outage notice from sprint over what looked like a code red packet flood everyplace On Tue, 18 Sep 2001, Bill Vermillion wrote: > On Tue, Sep 18, 2001 at 02:17:25PM -0400, Gary D. Margiotta thus > sprach: > > > Will also concur that we've seen it in our mix of BSD and Sun, > > Apache and NES/iPlanet servers. > > > I have heard reports of a 'resurgence' of the Code Red worm. > > I appears to be named the 'nimda' worm. On some of my very lightly > trafficed sites 60% of the log entries are error messages from > that, both in the access and error logs. The log shows > 9:31:15AM EST. > > I'm getting about 300 entries per hour in both the access log and > the error log - and these sites are relatively obscure but well > connected. > > > In addition, we just got word from one of our offices that there > > is another happy joy M$ Outlook-based e-mail attachement worm > > which goes through the address book, spams everyone in it and > > shares out the C: drive for unrestricted sharing. > > And totally off subject there is an InfoWorld columnist today > who pointed out the FrontPage license prohibits it's use on any > site that disparages, MS, MSNBC, Expedia, and a few others. With > the worms and this maybe a few more will rethink these products. > -- > Bill Vermillion - bv @ wjv . com > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-isp" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message