Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm.

• Previous message: Chris St. Clair: "Safe(?) testing for idq.dll vulnerability"
• Next in thread: LARD BENJAMIN LEE: "Mitigating some of the effects of the Code Red worm"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> No -- it is "constrained" because it has reached the *UTC date* (not 
> time as initially reported) when it is programmed to switch from 
> "spread like crazy" mode to "DoS one of the IPs that was part of 
> www.whitehouse.gov" mode.  In about ten days it will flick back to 
> the "spread like crazy" mode.

I've got to wonder about this - I've been tracing whitehouse.gov
(both old and new addresses) at several locations, and I'm not
seeing much traffic to it.

		Vern

• Next message: Vern Paxson: "Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm."
• Previous message: Chris St. Clair: "Safe(?) testing for idq.dll vulnerability"
• Next in thread: LARD BENJAMIN LEE: "Mitigating some of the effects of the Code Red worm"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jul 19 2001 - 22:42:19 PDT