>>>>Has anyone been having their IIS web sites turned off because of an attempt
>>>>to access the SCRIPTS directory. After we were hacked we removed this
>>>>directory. But this apparently causes the websites to be halted.
>>>
>>>http://support.microsoft.com/support/kb/articles/q300/9/72.asp
>>
>>Does this also apply to NT 4.0?
>
>I just got off the phone with an MS tech. He says its a worm called RedWorm. It shuts off the websites at some specified interval. At 12:00 midnight it will send 400 megs of data every 4 hours.
>
>Anyone know of a fix for this worm?

Our internet servers were hit with this one and all are presently down until further notice. Rather nasty virus I would say. The following was sent to all via email yesterday from our security officer:

Please the following warning. I think we already have several machine infected here at Crane. We have isolated them from the rest of the network.

Please keep your internet use to a minimum. If you don't need to go out to the internet for to accomplish your mission then please do not do so.

Crane's Public accessible Internet web site will be down until further notice.

NOTICE....

The rapidly spreading IIS Code Red Worm is a problem of sufficient
magnitude to bring the Internet's INFOCON Alert Status to YELLOW --
and that is now reflected at Incidents.Org.

If you or anyone you know has an IIS server, please get it patched,
now!

The patch is posted at:
http://www.microsoft.com/technet/security/bulletin/MS01-033.asp
[Yes that's a real Microsoft site]

Two hundred thousand systems may already have been infected. If you
are unsure whether yours is one of them, turn it off after you have
patched it. The current worm seems to disappear when the machine
is powered down, but you will be quickly reinfected if you are not
patched.

Please stay tuned to www.incidents.org and www.cert.org for further
information as it becomes available.

Sorry for any trouble this may cause

*****
Maybe the above link can help you.