Nimda takes out local ISP - News - Security

To print: Select File and then Print from your browser's menu

--------------------------------------------------------------
This story was printed from ZDNet Australia.
--------------------------------------------------------------

Nimda takes out local ISP

By Megan McAuliffe, ZDNet Australia
September 20, 2001
URL: http://www.zdnet.com.au/news/security/soa/Nimda-takes-out-local-ISP/0,130061744,120260597,00.htm

A Sydney-based Internet Service Provider (ISP) has revealed its painstaking task in getting its service up and running again after being viciously attacked by the Nimda worm yesterday.

HTMLnet, a niche ISP based in Sydney, told ZDNet Australia that its ten servers were literally being infected while the ISP was reading about the new virulent worm on the United States virus tracking Web sites.

-It was still too new for the local anti-virus companies to analyse the virus when it was hitting us," HTMLnet partner Matthew Robertson said.

Robertson said at least with past viruses they have had time to defend themselves.

The Nimda worm hit the ISP yesterday morning at 10.50, claiming ten servers and 12 client Web sites.

-It hit a client server which runs active content back to our servers, which infected us," Robertson said.

A report by ZDNet Australia yesterday revealed that the Nimda virus utilises Microsoft's Internet Information Server (IIS) directory and from there launches an attack on other Web servers.

-We've managed to clean eight of the ten servers, however, two of them we couldn't clean so we've had to rebuild them completely," Robertson said.

The ISP's main mail server and Web server are still down.