RE: Interesting Log entry

Looks like the new IIS worm.

Take care, 204.112.136.51 must be infected.

Jeremy

-----Original Message-----
From: Thomas W. Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx]
Sent: Thursday, July 19, 2001 10:02 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] Interesting Log entry


http://www.ISAserver.org


Anyone see a log entry like this recently in their web proxy log?

204.112.136.51, anonymous, -, N, 7/19/2001, 14:53:54, W3ReverseProxy,
MIDAS, -, www.worm.[inserted so you don't hurt yourself]com, -, 0, 360,
4039, 0, -, TCP, GET, http://www.worm.com[inserted so you don't hurt
yourself]/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3
%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b
%u53ff%u0078%u0000%u00=a, -, -, 12202, 0x0, Default rule, -

-----Original Message-----
From: Thomas W. Shinder
Sent: Thursday, July 19, 2001 2:05 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: isalist


http://www.ISAserver.org


Hey Everyone,

Stephen is the engine that makes the entire Isaserver.org organizaton
run. He's the guy that does the stuff behind the scenes, and without his
leadership, we all wouldn't have the great resources we have in
www.isaserver.org!

Three cheers for Stephen!

HTH,
:-)

Tom
www.isaserver.org/shinder


Thomas W Shinder, M.D., MCSE, MCT

-----Original Message-----
From: David Dellanno [mailto:david@xxxxxxxxxx]
Sent: Thursday, July 19, 2001 1:39 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] isalist



-A Jedi's life (Network Admin's life)

.it will be a hard life..one without reward...without
remorse....without regret.  A path will be place before you... the
choose is yours alone...do what your think you cannot do.   It will be a
hard life...but you will find out who... you really are.....

"Qui-Gon Jinn"

Keep up the good work Steve!
David V. Dellanno
msdemo.net
(Cel.) 678.778.7220
(Res.) 770.736.8794

------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')
To customise your settings for the list, kindly visit
http://www.webelists.com/cgi/lyris.pl?enter=isalist

------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
jeremyp@xxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
To customise your settings for the list, kindly visit
http://www.webelists.com/cgi/lyris.pl?enter=isaliss






GFI - Security & communications products for Windows NT/2000
http://www.gfi.com

**********************************************************
This mail was content checked for malicious code or viruses
by Mail essentials. Mail essentials for Exchange/SMTP is an
email security, content checking & anti-virus gateway that
removes all types of email-borne threats before they can affect
your email users. Spam, viruses, dangerous attachments & offensive
content can be removed before they reach your mail server.
In addition it has server-based email encryption, disclaimers
and other email features.
***********************************************************

In addition to Mail essentials, GFI also produces the FAXmaker
fax server product range & LANguard internet access control &
intrusion detection. For more information on our products please
visit http://www.gfi.com




Other related posts: