Re: The Return of Code Red II?

• Previous message: Kevin Patz: "Re: The Return of Code Red II?"
• Maybe in reply to: Stan Burditzman: "The Return of Code Red II?"
• Next in thread: Peter Kruse: "SV: The Return of Code Red II?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

At 11:24 AM 3/11/2003 -0600, you wrote:

>Is anyone else seeing traffic generated by Code Red II.  I thought it 
>wasn't supposed to propagate after 10/01?  Unfortunately I don't have the 
>whole string but here is the RealSecure Event.

Yeah. It's two bytes different. The two bytes control the 'stop' year. This 
one won't ever stop, although it will still take a vacation from October to 
December each year. I'm calling it CodeRed.F.

See... www.wormwatch.org

Roger





Regards

Roger Thompson
Technical Director of Malicious Code Research
TruSecure Corporation
www.trusecure.com
www.wormwatch.org


----------------------------------------------------------------------------

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>

• Next message: Peter Kruse: "SV: The Return of Code Red II?"
• Previous message: Kevin Patz: "Re: The Return of Code Red II?"
• Maybe in reply to: Stan Burditzman: "The Return of Code Red II?"
• Next in thread: Peter Kruse: "SV: The Return of Code Red II?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Mar 11 2003 - 12:47:24 PST