[Xitami-Dev] Weird stuff

[Paul Reid]

> at 22:30 on 1 August (I'm at GMT+1000). 

Yes, CodeRed had the idea of bombing the White House at midnight
on the first of the month.

Because it is a Windows worm and Windows can have a poor notion
of world time, and because many people neglect to set their Time
Zone, and because many people don't check the time on their
server, the "all at once" bombardment was spread over several
days. Still it was effective enough that White House was shut
down, and had to move to another IP.

If I'm reading it right, the same will happen on 1 September
etc., until enough people patch their servers that the infection
rate drops below the re-boot rate.  

(CodeRed dies in a re-boot, but if your IIS is un-patched and
there are a large number of active CodeRed machines in the world,
your IIS will be re-infected in hours.) 

(For big fun: it is possible for a IIS machine to have multiple
copies of CodeRed running (and each one is really 100 threads).
So an unlucky IIS machine can stall from all the load.) 

> some bozo at my ISP kept sending me private information automatically, three times an hour. 

Sounds like SirCam email worm. In fact I checked my mail today
mostly to see if "Glendaliz" had sent me yet ANOTHER one of
his/her awful files. So far I've collected: 

 Everyday I walk up down the same blocks.doc.lnk
 Leidner.doc.pif
 Maria V.doc.lnk
 Log 8.doc.com
 Assignment #1 (Dickinson).doc.com

I complained, no response; complained with copy to
abuse@rutgers.edu and got two more that night, then none in the
last 2 days. Either Glendaliz cleaned up the act or abuse killed
the connection.

Another person, who I do know, sent me 2 or 3 quite personal
financial files. (Do NOT try to read these files via Windows:
you'll get infected. Anyway you don't want to read other folk's
boring files.) A third person spared me but others were
complaining about him, so I had to scrub his machine. 

 -PRR