North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Worms versus Bots

  • From: Stephen J. Wilcox
  • Date: Tue May 04 08:23:56 2004

On Mon, 3 May 2004, william(at)elan.net wrote:

> Its possible its a problem on dialup, but in our ISP office I setup new 
> win2000 servers and first thing I do is download all the patches. I've yet 
> to see the server get infected in the 20-30 minutes it takes to finish it
> (Note: I also disable IIS just in case until everything is patched..). 

The frequency of scans is such that I'd say you have been lucky. 

Some worms also weight scans by IP (ie they can the local /16 more than the 
local /8 more than the /0).. in which case if you're a <large ISP> dialup 
customer you stand a higher chance of infection 

Steve