IDA "Code Red" Worm on IIS NT IIS 4 Server

[jbrooks]

Help, please.

Has anyone experienced the ida "Code Red" worm on their WIN NT 4 IIS server? The worm defaces the target website with the message: "Hello! Welcome to

http://www.worm.com

Hacked by Chinese!"

This is a recent worm and I need to know if their is a successful patch for it, where the patch can be downloaded, and exactly in what order to install it.

Any help would be appreciated.

 

[jaeddy]

Microsoft posted patches for the index server over a month ago.

http://www.microsoft.com/technet

Right now so many folks are hitting that site that the attack might as well have been directed at Microsoft. Anyhow, if you are worried, disable index server (Content Index in the Servces applet), reboot and wait until you can get in to download the patch. The worm is memory resident, so a reboot will clear it, but if your index server is not patched you will be quickly reinfected, so just can it.