Re: Explorer Dr. Watsons

["Jeremy 'Circ' Charles" <circi () wwoc org>]

On Tue, 18 Sep 2001, Chris Thornberry wrote:
> Has anyone been experiencing issues with Dr. Watson Application errors
> in EXPLORER.EXE. Ever since this morning and the W32.Nimda.A@mm issue
> some of my servers have had issues trying to run anything.
>
> Does anyone know of a relation between the two?

I was wondering about this myself..  My employer has an infected machine
that is exhibiting this behavior.  The only thing I'm able to do with the
machine is get the Task Manager up to confirm that I see the signature
processes of the worm (the easiest stand-out of which is something calling
itself TFTP).

In addition, we're experiencing an ARP storm on our network, presumably as
hundreds of infected machines all try to scan/exploit each other.  It's a
classic case of the argument for going from a flat switched Ethernet with
over 700 devices on it to a routed network.  I'm seeing over 800 ARP
requests per second.  :-)




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com