Code Red Worm Effected to 26xx

[Sreelu]

HI

Our Network is effected with Code Red Worm, and I had applied the MS patch for my IIS also. Still the ARP table in my Cisco 2600 is flooded with wrong entries, after some time the Router start to Denny the services (DOS). ( it’s clear that I had been effected with Code Red Worm) I had been applying the Advisory procedure Given Bye Cisco also. Still I am having the problem.

Any Help is appreciated.

Sreelu

 

[Sympology]

May not be Code Red, Blaster and Natchi do similar things. Even if the source has the Microsoft patch, the worms still need to be patched. Sorry to say, but you need to check every pc / server running Microsoft O/S for a) all the latest service packs and Hotfixes and b) they are all swept with an up to date Anti Virus program.

It's a long slow and annoying problem.

Stu..

 

[Sreelu]

hi Stu,

hmmmmmm, this is a ISP. And i dont think that i can really check all my hundre's of pc's. but still as far as i had done. i am finding this problem only in one part of my network. i.e. only in two city's.
And I had Update that network already with this fixes:

http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml

http://www.cert.org/advisories/CA-2001-19.html

http://www.microsoft.com/technet/security/bulletin/MS01-044.asp

Now, i am able to see that my router very seldome reboots but. still i see that.. my ARP table in router is flooded. and after some time(now it's few hours.) it reboots.

hmmmmmm......... huuuuu..... My Tickets are expiring......

Thanks. once again.
Some more help is antisipated.

Sreelu

 

[backupbob]

I had the same problem. I ended up enableing netflow on my router. I then used the command (sh ip cache flow | include 0087) this showed me the ip address of the 8 pc's that were infected with blaster on the network. As soon as I cleaned the virus off of them the router went down to 4% cpu usage.

Hope this helps.

 

[backupbob]

Also here are a couple of my favorite sites that may help with the port listings.

http://www.iana.org/assignments/port-numbers

http://natali.mine.nu/test2.html

 

[bierhunter]

I've used the same technique backupbob did to track down infected machines. Works great, and very quickly ID's the culprits.