[Dshield] well that's good news then

Jon R. Kibler Jon.Kibler at aset.com
Fri Oct 18 23:34:50 GMT 2002


In the 'For What It Is Worth' category, I have had over 800 code red hits in the past week from one infected system -- IP 24.186.146.199 -- the mail system for nesconsetfd.org, a community fire department in NY. 

What I find strange is that they (the FD) claim that mail is all that runs on that system. (I haven't had a chance to check out that claim.)

Also, they do not have admin access to that system and their ISP (optonline.net/cv.net), who does have admin access, seems to be unwilling to do anything about the problem. I have been on the ISP's case daily, as has their customer!

If anyone else it getting hit by this IP, I wish they would complain loudly to CV.NET about the problem!

Jon Kibler

Toby Miller wrote:
> 
> Over the past week I have seen 5 or six code red attempts on my IDS(s). All
> of them have been from Asia. Just my .02 worth.
> 
>                                                         Toby
> 
> -----Original Message-----
> From: list-admin at dshield.org [mailto:list-admin at dshield.org]On Behalf Of
> Susan Buczak
> Sent: Wednesday, October 16, 2002 9:10 PM
> To: list
> Subject: [Dshield] well that's good news then
> 
> NNNNNNNNNNNNNNNNN...
> 
> just a stray bug running amuck.
> 
> didn't even know code red was still out there.
> 
> probably just infected servers reinfecting themselves by now...
> 
> safely block those then I guess, thanks for the expertise.
> 
> BTW for all those those needing pop email bug relief I have found this
> item, available at at sourceforge.net to be quite useful.. avialable for
> both windows and linux systems.
> 
> called 'save my modem'... look it up at sourceforge. delete the junk
> mail in your popbox before you download, not after..
> 
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
> http://www.dshield.org/mailman/listinfo/list
> 
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list