Re: [LUG] OT: spam

[Luke <luke@xxxxxxxxxxxxxxxxxxxxxxx>]

Paul Weaver wrote:

> On Thursday 18 September 2003 23:27, you wrote:
>  
>
> > Is that the one that claims to be from M$ Program security Dept? If so
> > I've got it too. I just hope that my family doesn't recieve a spam like
> > that on my Win98 home PC, they would run it... I don't think I can teach
> > them to distinguish good attachments from bad, gonna have to try though
> > cause else it's gonna be me sorting out their problems.
> >    
>
> Yeah, I had similar one to that - a .bat file which was an executable 
> (started with MZ). Had about 5 today with large attachments that spam 
> assassin didnt catch (or did catch but only on one or two stars). Very 
> annoying if I was on a modem.
>
> --
> The Mailing List for the Devon & Cornwall LUG
> Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
> message body to unsubscribe.
>  
Tell you what this spam and virus trend is getting more frequent each 
week it seems.

Today at work eclipse pulled the plug after what they saw as a DOS of 
icmp packets were hurled at them by the business park where i work. 
Turns out some windows hosts were infected with welchia worm (the one 
that fixes the rpc vunerabilty). This little blighter flings pings all 
over the subnet on which it presently resides. When it finds a host who 
has not been patched, it uses tftp to download the MS rpc patch. 
Bandwidth gets sucked up LAN comes to a standstill.

As luck would have it we did not get any infection as all our doze boxes 
are patched and the nix box acting as gateway stopped the blighters 
getting in.  i put the ext_int into promiscuous mode, took a dump 
(packet that is:)  and there was a torrent of arp/icmp packets flying 
everywhere. it was like a tcp/ip version of a spagetti western.

In the end the main sys ad pulled the plug on everything and went round 
with a rpc vunerabilty scanner looking for any culprits.

Another day another dollar.

Just tried out knoppix. Nice! quite impressed. shame they don't do a 
gnome version as well.

Luke



--
The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe.