Nate Carlson [natecars at real-time.com] wrote: > On Mon, 6 Aug 2001, Clay Fandre wrote: > > > > Thanks for all of the help. I was starting to get worried when my cable > > > > modem & router lights were going crazy last night and the fact that I > > > > heard that there is a new strain out that effects shells or something. > > > > > > Not "effects shells", really. It makes a shell available (without any > > > authentication, of course) available remotely on infected machines. > > > > > > > Any idea how to access it? Does NT have a shutdown command? :-) > > get /scripts/root.exe That only answers half of my questions. Anyone have time to modify the worm to go and shutdown all these damn unpatched boxes? Or better yes, have it download and boot a linux fs.