[ale] Code Red II

[SAngell at nan.net]

I have been watching hits coming through trying to dump this payload all day. In
case anyone is running IIS out there. This second strand drops a backdoor trojan
onto your IIS 4 or 5 server and the taletell sign will be a gile called
ROOT.r\exe which will be dropped into your

Steve Angell,  MCSE, CCNA
MIS Operations Manager
TSYS Total Debt Management
Phone 770-409-5570
Fax      770-416-1752


|--------+------------------------>
|        |          "Transam at cavu.|
|        |          com" <transam |
|        |                        |
|        |          08/06/01 03:18|
|        |          PM            |
|        |                        |
|--------+------------------------>
  >--------------------------------------------------------|
  |                                                        |
  |      To:     ale at ale.org                               |
  |      cc:     (bcc: Steve Angell/tdm)                   |
  |      Subject:     [ale] Code Red II                    |
  >--------------------------------------------------------|





>From the AJC (but useful anyway, IMO)...

NATIONAL TECH NEWS . . .

NEW WORM DUBBED CODE RED II
   A new worm, aping the injection vector of the now infamous Code Red worm
but carrying a much more dangerous payload, was found Sunday, according to
security firms Security Focus and eEye Digital Security.
http://www.ajc.com/business/ap/codered2.html

NEW CHIEF AT GOOGLE
   Web search operation Google Inc. named the former CEO of Novell Inc. as
its chief executive, succeeding 28-year-old Larry Page, one of the site's
founders. The privately held Mountain View, Calif.-based company selected
Eric E. Schmidt, 46, who had been appointed chairman of Google's board of
directors last March. Page will become products president, and co-founder
Sergey Brin, 27, will become technology president.

Kind of scary that I knew Eric Schmidt when we both were students
at Berkeley.  It's rare that an engineer hits the big time.  --Bob

Bob Toxen
transam at cavu.com                       [Bob's ALE Bulk email]
bob at cavu.com                           [Please use for email to me]
--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.



--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.