Defense Tools Security Checkup . Free Online Self-Scan . DDOS Zombies Scan . Internet Worm is a collection of scripts and programs whose function is to automatically exploit the remote BIND vulnerability in linux systems in order to gain access, and attack other systems from each compromised host, copying itself to each vulnerable system. This worm is linux specific, and affects default installations of Redhat Linux from Redhat 4.0 to 5.2, and possibly systems using ISC BIND code based on 4.9.6.
Affected systems are limited due to the exploit that the worm tries to use to gain remote access.
There were several strains of the ADM worm, some including backdoor functionality. Having prepared the local system, the worm next scans for other new targets in a incremental method with a pseduo-random starting address. If any of the octets in the IP address reach 230 they are reset to equal zero. The first octet is not reset when incrementing so the scanning stops at 229.230.230.230. The number of systems scanned by the worm depends on how low the random starting address was.