Re: am i being wormed? aaugh!

[John Griffiths <john@capmon.com>]

At 05:05 PM 8/4/01 +0100, Christian Jaeger wrote:
>Just to the record: there seems to be a new variant of the worm, with 
>all 'N' being replaced with 'X'. The last 117 (er, now thei'r 119) 
>worm requests on my machine, starting 5 hours ago, were all except 
>one of the 'X' type. And all of them come from 62.2.x.x (well, I'm on 
>this subnet, too). Seems like someone wanting to kill this internet 
>providers clients has rewritten the worm to attack all ip's in this 
>subrange (instead of the semirandom ip's it used to select before).
>
>no fun for windows users
>
>christian.
>


That's be Code Red 2.0, it's making as yet undocumented jumps but then really creaming it's subnet...

moral of the story, don't allow windows NT on your subnet