RE: Nimda Virus
Title: RE: Nimda Virus er no ... you meet on IRC get the other guys IP and then you ... Justin -Original Message-From: Nusairat, Joseph F. [mailto:[EMAIL PROTECTED]]Sent: 18 October 2001 04:02To: Orion-InterestSubject: RE: Nimda Virus Wow i didnt believe rudeness was a part of these forums. SHould we now meet out back at lunch and fight? I believe thats how it goes. ANYWAY ... i think the other guy was right about it propogating through the file sharing ports i believe we had one or two that were open Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] -Original Message-From: J.D. Bertron [mailto:[EMAIL PROTECTED]]Sent: Thursday, October 18, 2001 8:14 AMTo: Orion-InterestSubject: RE: Nimda Virus Get a clue. You work for MCI WorldCom. What did you expect ? -Original Message-From: Nusairat, Joseph F. [mailto:[EMAIL PROTECTED]]Sent: Wednesday, October 17, 2001 4:29 PMTo: Orion-InterestSubject: RE: Nimda Virus lol ... well how did we get infected??? Does anyone have any clue how that could happen? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] -Original Message- From: Hani Suleiman [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 17, 2001 10:15 AM To: Orion-Interest Subject: Re: Nimda Virus Of course not, it only affects IIS. On Wed, 17 Oct 2001, Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED]
RE: Nimda Virus
Title: RE: Nimda Virus Get a clue. You work for MCI WorldCom. What did you expect ? -Original Message-From: Nusairat, Joseph F. [mailto:[EMAIL PROTECTED]]Sent: Wednesday, October 17, 2001 4:29 PMTo: Orion-InterestSubject: RE: Nimda Virus lol ... well how did we get infected??? Does anyone have any clue how that could happen? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] -Original Message- From: Hani Suleiman [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 17, 2001 10:15 AM To: Orion-Interest Subject: Re: Nimda Virus Of course not, it only affects IIS. On Wed, 17 Oct 2001, Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED]
RE: Nimda Virus
Title: RE: Nimda Virus Wow i didnt believe rudeness was a part of these forums. SHould we now meet out back at lunch and fight? I believe thats how it goes. ANYWAY ... i think the other guy was right about it propogating through the file sharing ports i believe we had one or two that were open Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] -Original Message-From: J.D. Bertron [mailto:[EMAIL PROTECTED]]Sent: Thursday, October 18, 2001 8:14 AMTo: Orion-InterestSubject: RE: Nimda Virus Get a clue. You work for MCI WorldCom. What did you expect ? -Original Message-From: Nusairat, Joseph F. [mailto:[EMAIL PROTECTED]]Sent: Wednesday, October 17, 2001 4:29 PMTo: Orion-InterestSubject: RE: Nimda Virus lol ... well how did we get infected??? Does anyone have any clue how that could happen? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] -Original Message- From: Hani Suleiman [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 17, 2001 10:15 AM To: Orion-Interest Subject: Re: Nimda Virus Of course not, it only affects IIS. On Wed, 17 Oct 2001, Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED]
Re: Nimda Virus
Of course not, it only affects IIS. On Wed, 17 Oct 2001, Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED]
Re: Nimda Virus
We've had tries from the Nimda virus trying to exploit, but there is nothing in Orion which would allow it to. It was trying to call some EXE files, and the virus is stupid enough to not realize that the server is trying to serve up those files and that they don't exist, and that it should just move on with its life. For anyone seeking to stump those worms, here is an article about an Open Source piece of software that will trap worms and keep them busy, while you clean things up and save your servers from disaters. http://www.eweek.com/article/0,3658,s%253D708%2526a%253D15339,00.asp Hope this helps. R Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED]
Re: Nimda Virus
No, and my server gets hit mercilessly day in and day out. :) On Wed, 17 Oct 2001, Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] --- Joseph B. Ottinger [EMAIL PROTECTED] http://adjacency.org/ IT Consultant
RE: Nimda Virus
Title: RE: Nimda Virus lol ... well how did we get infected??? Does anyone have any clue how that could happen? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] -Original Message- From: Hani Suleiman [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 17, 2001 10:15 AM To: Orion-Interest Subject: Re: Nimda Virus Of course not, it only affects IIS. On Wed, 17 Oct 2001, Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED]
Re: Nimda Virus
Nusairat, Joseph F. wrote: lol ... well how did we get infected??? Does anyone have any clue how that could happen? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] -Original Message- From: Hani Suleiman [ mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 17, 2001 10:15 AM To: Orion-Interest Subject: Re: Nimda Virus Of course not, it only affects IIS. On Wed, 17 Oct 2001, Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] You've probably got someone using a windows browser on the machine and they hit a site with a page that had the virus on it. That's what forlks get for using servers as a personal workstation :-) R
Re: Nimda Virus
Nimda also propogates through network shares that are not password protected. Jeff. On Wed, 17 Oct 2001 16:29:22 -0400 Nusairat, Joseph F. [EMAIL PROTECTED] wrote: lol ... well how did we get infected??? Does anyone have any clue how that could happen? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED] -Original Message- From: Hani Suleiman [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 17, 2001 10:15 AM To: Orion-Interest Subject: Re: Nimda Virus Of course not, it only affects IIS. On Wed, 17 Oct 2001, Nusairat, Joseph F. wrote: Have any of u had issues with this exploiting the Orion App? Joseph Faisal Nusairat, Sr. Project Manager WorldCom tel: 614-723-4232 pager: 888-452-0399 textmsg: [EMAIL PROTECTED]
