From: Jeff Shultz 

On Tue, 29 Jun 2004 08:33:26 -0400, Geo. wrote:

> Any of you running W2K web servers (or any internet exposed W2K machines)
> could you do me a favor?
>
> I'm hearing from people who have a new account showing up called IWAP_WWW
> which is meant to look like an IIS account but as far as I can tell it's a
> compromise situation. None of my machines have this so I need to find
> someone who does and get them to run shavlik hfnetchk or some other hotfix
> check to see what patch they don't have applied.
>
> If any of you find this please let me know? georger{at}nls.net
>
> Geo.

Oh, the one that got that guy yelled at on nanog a week or so ago.

I'll check in the morning.

--- BBBS/NT v4.01 Flag-5