RE: [cobalt-users] worm attack

[flash22@xxxxxxx]

On Wed, 19 Sep 2001, Larkin Cunningham wrote:

> Would a symptom of this worm be lots of internet traffic simultaneously
> going in and out of your client windows PC despite not doing anything that
> should cause such traffic? I noticed the Trivial FTP executable (tftp.exe)
> going mad on my windoze 2000BC laptop. I couldn't kill the processes, so I
> had to lock it with my personal firewall.

Probably, lots out outbound web traffic is more likely, look for load.exe
in the windows/system folder, if it's there you probably got nailed...
Unfortunatly, the thing is somewhat variable about what it does and where
it goes...

A disk search for readme.exe is probably wise, in any case, the virus
scanning sites have already released pattern updates for this thing...

gsh