Here is more info:

http://securityresponse.symantec.com/avcenter/venc/data/w32.nimda.a(at)mm.h
tml

Watch the word wrap on the URL.

It tries to infect IIS machines and when going an infected web server it
tries to open a file called "readme.eml" and download "readme.exe".

You can view source of the suspected web page and see if these lines are
there:

<.html><.script language="JavaScript">window.open("readme.eml", null,
"resizable=no,top=6000,left=6000")<./script><./html>
<.html><.script language="JavaScript">window.open("readme.eml", null,
"resizable=no,top=6000,left=6000")<./script><./html>

************************
Mike Carlson
http://www.domitianx.com
domitianx(at)domitianx.com

Thought Of The Moment:

"My software never has bugs. It just develops random features."
************************

-----Original Message-----
From: owner-hwg-techniques(at)hwg.org [mailto:owner-hwg-techniques(at)hwg.org]
On Behalf Of Rob Taylor
Sent: Tuesday, September 18, 2001 11:04 AM
To: hwg-techniques(at)hwg.org
Subject: Please Read This Announcement Everyone


Hello everyone

I know it is not good practice to send messages about viruses but there
is a nasty one going around.  It has no attachment and it will run just
by highlighting the subject.  Any emails you receive that have the
subject "sample ads sample ads sample ads sample ads sample ads sample
ads sample ads " is a vicious virus of some kind.  I believe it is
grabbing IP addresses (probably from domains in your mailbox) and then
launching heavy denial of service attacks on those web sites.  I habeen
in contact with 3 ISPs this morning who are experiencing difficulties.

Again this is not a hoax and I am only trying to spare some grief.

Regards,

Rob Taylor
TConsult, Inc.
www.tconsult.com
Bullet Proof Member Services Sites
716-367-2483
rob(at)tconsult.com

• Web Designer Courses
• Off the Shelf Training Courses

HWG hwg-techniques mailing list archives, maintained by Webmasters @ IWA