RE: MSIIS servers patched/de-doored, but C and D keep coming back

From: Krull, Chris (Chris.Krull@anheuser-busch.com)
Date: Tue Aug 14 2001 - 09:20:42 PDT

  • Next message: Tamer Sahin: "tamersahin.net Code Red Cleaner v1.0"

    I would suggest starting to look in the metabase, if the entries appear back in
    the registry. To do this you will need metaedit from microsoft
    http://support.microsoft.com/support/kb/articles/Q232/0/68.ASP
    
    Thank you, 
    Christopher Krull 
    Internet Architect 
    Anheuser Busch Internet Computing 
    
    
    
    -----Original Message-----
    From: Garreth Jeremiah/Markham/IBM [mailto:gjeremiaat_private]
    Sent: Monday, August 13, 2001 3:28 PM
    To: incidentsat_private
    Subject: MSIIS servers patched/de-doored, but C and D keep coming back
    
    
    I have been receiving a number of reports suggesting that on certain
    devices, after full patching and cleaning - the /C and /D keep coming back
    after a reboot.
    
    Anyone explain what is happening?  Is this an IIS thing or a Windows thing?
    
    ( note some of these macheines were runnign the French Version of Win2K )
    
    Thanks
    ______________________________
    Garreth J Jeremiah.
    
    
    
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Aug 14 2001 - 11:25:08 PDT