RE: Codered?

[Martin Blackstone]

Title: Message

Here is what I do.

Install w2k with the machine on the network. add to domain, etc

Shut down.

Remove network cable

Boot

Disable all IIS services

plug cable back in

reboot

apply SPs and patches

reboot

enable IIS

-----Original Message-----
From: Luke Brumbaugh [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 24, 2001 7:34 AM
To: NT System Admin Issues
Subject: RE: Codered?

Same here.  If you use that coroporate.windowsupdate.microsoft.com you can drag to cd or spare drive on Computer, unplug from net and load OS.  I did this and now I am fine.

Read "Code Red Rant" message thread.

 

-----Original Message-----
From: Niki Blowfield [mailto:[EMAIL PROTECTED]]
Sent: Friday, August 24, 2001 9:59 AM
To: NT System Admin Issues
Subject: Codered?

Hi

 

I installed a Win2k Advanced server in a kind of test environment on a public

IP address last thing yesterday, and it appeared to pick up the codered worm

overnight.

 

i got an email from one admin, and an automated message from a website

 

i re-installed 2k serv and applied the IIS patches, I also applied the patches to

my 2 NT servers which have IIS4 running, albeit on a private subnet

 

i have since noticed LOTS of traffic coming in through our single ADSL connection

 

i can remove our Firewall from the ADSL router, so its connected only to the web,

but the traffic continues on the router indicator lights, so it doesnt seem to be

originating from our network

 

the 2000 server is the only device on our network providing any kind of services

to the internet, and that is currently offline

 

we have no way of connecting to the router to check logs, but if I bring the 2000

server online, and run netmon, i get constant entries like the following;

 

SRC MAC Address - FLOW00......

Dest MAC Address - LOCAL

Protocol - TCP

SRC Other Address - 213.66.79.235

Dest Other Address - WIN2KADVSERV

Type Other Add - IP

 

do we still have a problem? or are these other sites with the virus attempting to

send it to us?

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

Enterprise Channel Management Software for Manufacturers

Visit us at http://www.ultryx.com

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm