Dan and Tim,


Two NT4 (service pack 6) servers were hit by this same problem in 
University Relations. One was hit on May 1. It was replaced by a 
secondary server and that was hit on May 2. Same symptoms. 
Widespread file deletion. Bob Dang servers.  Unusual message 
said "<color><param>7400,8F00,B300</param><bigger>©Copyright 1996–2002 Fucking University of 
Rochester. All rights reserved.<color><param>0100,0100,0100</param><FontFamily><param>Times New Roman</param> "<smaller>


<FontFamily><param>Arial</param>We've reported the problem to IST-CNS (Eric Chamberlain), IST-
SNS (Craig Lant), and campus police (Detective Bruce Bauer) who 
are investigating the problem.  I'd like to hear of any other 
departments who may have been hit.<FontFamily><param>Times New Roman</param><bigger>




</color><FontFamily><param>Arial</param><smaller>Date sent:      	<color><param>0000,0000,8000</param>Fri, 03 May 2002 16:16:24 -0700</color>

To:             	<color><param>0000,0000,8000</param>Tim Heidinger <<timh@uclink4.Berkeley.EDU>,</color>

      	<color><param>0000,0000,8000</param>micronet-list@uclink4.Berkeley.EDU</color>

From:           	<color><param>0000,0000,8000</param>Dan Percival <<dperciva@uclink4.Berkeley.EDU></color>

<bold>Subject:        	<color><param>0000,0000,8000</param>Re: [Micronet] May 1st Windows Attacks??</bold></color>


At 02:49 PM 5/3/2002 -0700, Tim Heidinger wrote:

<color><param>7F00,0000,0000</param>>I've heard of a two instances where Windows machines that were

>rebooted on May 1st had their hard drives rendered unusable.  I'm

>wondering if this was a limited thing of if others experienced the

>same thing?


</color>Two machines in MCB were struck by this problem, both running 
NT4

(service pack 5). The main symptom is widespread file deletion

including NTLDR, ntoskrnl, etc. Both users also reported having

problems with programs crashing out and some files disappearing 
just

before the reboot that ended it all.


This may be a bit of a red herring, but both machines were provided 
by

Affymetrix for data analysis with all software pre-installed. The

vendor-supplied software did not include virus protection. Affymetrix

had nothing to say on the subject.


No info yet, but you're not alone.


Dan Percival

MCB Computer Help



----------------------------------------------------------------------

-- The following was automatically added to this message by the list

server:


For information about Micronet, including subscribing to

or unsubscribing from its mailing list and finding out

about upcoming meetings, please visit the Micronet Web site:

<<http://micronet.berkeley.edu/>.

<nofill>
Peggy Flens
Mgr, Network Computing Services
University Relations
University of Calif, Berkeley
voice(510)642-3305 
fax  (510) 643-6130


------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.berkeley.edu/>.