[TriLUG] OT: Finding/Notifying People with Worm-infested PC's

[Jaimie Livingston]

> On Tue, 2004-04-20 at 16:04, Jaimie Livingston wrote:
> 
> > I have a small web-server that I run at home for personal and development
> > use, and I've been tagged by a few Worm-infested Windoze boxes, probably
> > some home PCs that the users have running wide open on the Internet. I have
> > the IP addresses, some from RR, and would like to find these people and let
> > them know that they are doing the world a disservice by leaving an infected
> > Windows box up and running, and maybe give them some pointers on how to
> > prevent such a thing from happening. 
> > 
> 
> All you can really do is forward the e-mail (with full headers) to the
> appropriate abuse/postmaster addresses, which would be for example
> abuse at nc.rr.com for RoadRunner customers.  Not sure it will 
> do that much good but it's worth a try.  I don't really worry about it myself as
> SpamAssassin seems to catch most of the worm e-mail that I get.
> 
> --Jeremy

Except is not e-mail that's bugging me, it's the way Nimbda, CodeRed, and the WebDAV worms
are cluttering my Apache logs. It's not a huge concern, but it is a pet peeve. Do you
think the sending them excerpts from the logs will be of use? 

Jaimie