CODE RED WORM PATCH ISSUES

[roojam]

I installed the code red worm patch from microsoft last week on all our desktops and servers. Yesterday we got hit by the virus. After checking the servers we discovered that the patch was not on some of the machines. Has anyone else suffered from this or have any idea why???

Seem svery strange to me.

Regards

Richard.shuttlewood@webtradingservices.co.uk

 

[2ffat]

It sounds like you are not the only one. This is an excerpt from one of my mailing lists:

Several messages on the Bugtraq security mailing list
indicate that the original Code Red is causing some servers
running IIS (Internet Information Service) 4.0 and Windows
NT 4 to crash, even if the patch for the now-famous buffer
overflow vulnerability in the .ida DLL has been installed.

Users report that their IIS servers are stopping
periodically and must be rebooted in order to restart the
services.

And the new Code Red II worm is continuing to infect IIS
servers and is also causing some proxy servers to crash.

You should be able to read more at

http://www.eweek.com

. Do a search for "code red."
James P. Cottingham

I am the Unknown lead by the Unknowing.
I have done so much with so little
for so long that I am now qualified
to do anything with nothing.

 

[Kjonnnn]

Did you installed both patches.. for Code Red I and Code Red II?

 

[roojam]

I didn't realise there was a patch for Code Red 2. Does anyone have the link for it off hand?????

I thought Code Red 2 came in through the same way as Code Red 1.

Thanks for your help on this one people

Rich

 

[2ffat]

Apparently MS got it in MSN, Hotmail, and internally. It appears that someone brought in an infected laptop and infected their servers. See

http://www.theregister.co.uk/content/4/20937.html

.
James P. Cottingham

I am the Unknown lead by the Unknowing.
I have done so much with so little
for so long that I am now qualified
to do anything with nothing.

 

[Kjonnnn]

Go Here:

http://www.symantec.com/avcenter/venc/data/codered.ii.html