 |
 |
Hey mike, I had a 95 workstation that had personal web server running along with Front Page that was infected. (IIS lite) Might want to check that out. -----Original Message----- From: Peter Chin [mailto:[log in to unmask]] Sent: Thursday, November 01, 2001 3:42 PM To: [log in to unmask] Subject: Re: nimda-e worm Before you try scrubbing your server again I would recommend throughly checking your workstations. Nimda is not a server-only worm like some of it's predecessors, which took advantage of the same IIS vulnerabilities. There is a potent workstation component that spreads via email, network shares and infected web sites. If you have an infected desktop that accesses your server it could be dropping and/or modifying files on your server. here Network associates blurb on it: http://vil.nai.com/vil/virusSummary.asp?virus_k=99209 Peter Chin Network Administrator Office of the Controller Michigan State University 146 Administration Building East Lansing, MI 48824 Ph. (517) 353-4443 Fx. (517) 353-1046