"My bad for mentioning the virus name. I do not remember which one now, (I thought it was Nimda,)"
You are right my friend. That's exactly what nimda does. It also adds javascript to every asp, htm, html to automaticly run an .eml file to infect anyone who visits the page. Cory Coddington Webmaster / IT Administrator / Network Engineer 888-362-9237 Ext:255 http://www.movecost.com http://www.nationwidereloservices.com http://www.wehaulmoving.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Friday, September 27, 2002 2:32 AM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Firewalls and email servers First, my response was not meant as counter point or put down. I appologize if it came across that way. >I have to wonder exactly how you construed my noting a quick answer to be the equivalent of a recommendation. Perhaps you would care to explain. It was for the sake of discussion. In this time of security awareness necessity, some people will take a quick answer and run with it, as has been demonstrated on this forum before. My response was meant to discuss that although there is often times a quick answer, when dealing with issues of security, it is recommended to view various options. >As for how Nimda spread, my understanding was through e-mail and network shares, something unrelated to an Internet firewall. Perhaps you might elaborate on your point. Please review Symantec's link below for further information concerning Nimda. My bad for mentioning the virus name. I do not remember which one now, (I thought it was Nimda,) that would plant/infect the IIS server with a very small file, which would then create a TFTP session to a programmed remote server and would then download the main virus payload. If outbound TFTP had been blocked, the virus would not have been able to connect to the remote server and there by cause the damage it did and propagated like it did. John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
