[Xitami] Suspend

[Brian {Hamilton Kelly}]

In message <001e01c13616$b64462c0$49409fc1@ednic>
   joubin.far@t-online.de (Joubin Far) writes:
> Hi Ewen,
> By your tip i have found the Ghost and Zombie that lives in background an
> d
> makes the life difficult for Xitami.
> The Ghost is called IIS you was right.
> I couldnīt belive it because i didnīt installed it direct.
> It was installed by Visual Studio.net package by clicking on OK and with 
> it
> i have installed IIS server and some other server option.

Sadly, far too many other M$ victims have also found that IIS has been
installed and running by default: along with an ftpd and smtpd.  (I'm a
customer of Demon Internet in the UK, and they, unlike many ISPs, attempt
to *deliver* mail by SMTP by default when a customer connects, albeit
that many of their Windoze-bound customers only have a POP3 client with
which to *collect* mail.  You would not believe the number of times that
Demon customers have changed to using Win2K and discovered that an smtpd
has been installed by deault, which answers all the incoming mails by
bouncing them.  The first they know is when their friends/customers/what-
ever complain that their mails are being bounced.).

As others have said, if your system was not properly protected, there is
a VERY strong possibility that you have been infected by Code Red (2),
and that you are one of the 30,000+ systems running IIS which are
continuing to attempt to infect other systems, and also to commit a
Denial of Service attack upon www.whitehouse.gov.

Furthermore, if it's Code Red II that's infected you, it may well have
installed one or more trojans that will leave your system open to
repeated infestation and exploitation.  Do PLEASE check the various sites
warning of the dangers.  If you *have* been infected with CR2, the ONLY
safe course is to wipe your disk(s) entirely and reinstall Win2K from
scratch; do please note that this means FDISK and FORMAT to erase
*everything* that was already there; a simple re-install over a working
system will NOT remove the infection.

(Just one of the penalties of running Billy Shit software.)

-- 
Brian {Hamilton Kelly}                                          bhk@dsl.co.uk
    "We have gone from a world of concentrated knowledge and wisdom to one of
    distributed ignorance.  And we know and understand less while being incr-
    easingly capable."              Prof. Peter Cochrane, formerly of BT Labs