[Xitami] "GET /scripts/.......

[Paul Reid]

>Today I'm getting many thousands of hits from hundreds of IP's 

GET /scripts/..%%35c../winnt/system32/cmd.exe?/......

> Is it simply my turn this crap today?

It is everybody's turn. 

>From my school's network group: 

"This morning, the Network Operations Group became aware of an issue
concerning our Internet connectivity. Upon further investigation, the
problem was determined to be a virus that was attempting to infect the
University.

"The virus is of a particularly aggressive variety, attacking both
clients and servers on the network. The rate of infection is such that
we believe all vulnerable hosts within the university either have or
will be infected. Throughout the day, TD has observed hundreds of
network devices attempting to spread the virus to the University
Community and the Internet. As a result of this activity, the University
Internet connections were brought to a near standstill."

This is happening all over the world... even the news-radio mentioned
it.

Near as I can tell, MS IIS server is involved, Xitami shrugs it off.

BTW, net-connected H-P printers may need re-booting after every job.

However, there is also an email component called "readme.eml" or
"readme.exe". If you get any email attachments, or your web browser
offers to download or run anything like that, say NO!

Watch any of the major anti-virus web-sites for more info.

 -PRR