Re: [MLUG] concept virus

["Sam" <EMAIL:PROTECTED>]

Ohhh the heat from the flame.
    Yes I was running the updates, DUHHHHHHHH. When some one hit a server
(Automated Systems Consulting) from where the virus had already infected
there site (the 983buzz.com) and got an auto popup of  Media player (They
were infected right then). You know it is implanted as a line in an infected
html/asp/shtml file. Then by delivering its payload attacked the server.  Oh
you know that there wasnt a def update for the virus till yesterday.The
entire office uses outlook2001, not express so the MIME patch wasn't woth
sh*t.
    So wow I guess that is administration, protect form viruses that aren't
known of before it happens. Ohhhh and it walked right through the BSD
firewall on port 80, whats the ipfw rule to stop that?

    From the administrator that has been cleaning viruses all day. Ohh did i
mention that norton antivir for exchange got nailed as well?

Thanks for all the support, and help in the usage of linux.
----- Original Message -----
From: "Dev Null" <EMAIL:PROTECTED>
To: <EMAIL:PROTECTED>
Sent: Thursday, September 20, 2001 11:50 AM
Subject: Re: [MLUG] concept virus


> From: "Sam" <EMAIL:PROTECTED>
>
> >     I did administer and exchange server for a local company, (yes I
know
> > this is hosted on an NT machine) . Now i am in the process of rebuilding
> > there NFS as well as e-mail system with some flavor of *NIX.
Suggestions?
> >     I did mention that this change was brought about after an updates
> virus
> > scan that detected 1842 files infected with one of three instances of
the
> > NIMDA worm?
>
> Oh. . .So you weren't running security updates/patches every week?
>
> Doesn't sound much like "administration" to me. . .
>
> Then again, neither does changing a whole system over because you weren't
> doing your job in the first place.
>
> T3/Dev
> Who spent all of yesterday preventing such things and further hardening an
> entire network against infection.
>
> --
> To unsubscribe, go to http://mlug.missouri.edu/members/edit.php
>
> Archives are available at http://mlug.missouri.edu/list-archives/
>

--
To unsubscribe, go to http://mlug.missouri.edu/members/edit.php

Archives are available at http://mlug.missouri.edu/list-archives/