RE: Code Red

2001-08-08 Thread Paul Vincent
To: Multiple recipients of list ORACLE-L Subject: RE: Code Red Yeah, that's what I read. I had applied the patch and I don't have Code red or Code Red II, however it appears that I have something else. It doesn't seem to have worked but it looks like someone tried to deface our website

RE: Code Red

2001-08-08 Thread Kevin Kostyszyn
PROTECTED]] Sent: 07 August 2001 18:27 To: Multiple recipients of list ORACLE-L Subject: RE: Code Red Yeah, that's what I read. I had applied the patch and I don't have Code red or Code Red II, however it appears that I have something else. It doesn't seem to have worked but it looks

RE: Code Red

2001-08-08 Thread Anderson, Brian
Can read all about sadmind at cert. http://www.cert.org/advisories/CA-2001-11.html -Original Message- From: Kevin Kostyszyn [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 08, 2001 10:11 AM To: Multiple recipients of list ORACLE-L Subject: RE: Code Red Paul, Thanks

RE: Code Red

2001-08-08 Thread Anderson, Brian
The trouble with code red was that it went through port 80, which is left open by firewalls because that is the port used for HTTP pages (WWW). Closing that would mean no one could access Web pages. So firewalls won't help you re. things like that. You can now go through any ports

re: code red

2001-08-08 Thread Eric D. Pierce
Kevin, don't you loove Uncle Bill's Fine Software? http://www.google.com/search?hl=ensafe=offq=code+red ( http://www.securityfocus.com/headlines/12142 , http://www.digitalisland.net/codered , http://www.digitalisland.net/codered/CodeRed.pdf ,

RE: Code Red

2001-08-07 Thread Boivin, Patrice J
Read http://aris.securityfocus.com/alerts/codered2/010805-Analysis-CodeRedII.pdf http://aris.securityfocus.com/alerts/codered2/010805-Analysis-CodeRedII.pdf Patrice Boivin Systems Analyst (Oracle Certified DBA) Systems Admin Operations | Admin. et Exploit. des systèmes Technology Services

RE: Code Red

2001-08-07 Thread Anderson, Brian
The worm is just memory resident, so a reboot should get rid of it, BUT without the patch, you'll get it right back. The problem for the new version is it deposits a trojan backdoor on your server. Mcafee dat 4152 is supposed to find the trojan, I'm sure other virus scanners are releasing

RE: Code Red

2001-08-07 Thread Kevin Kostyszyn
Yeah, that's what I read. I had applied the patch and I don't have Code red or Code Red II, however it appears that I have something else. It doesn't seem to have worked but it looks like someone tried to deface our website. It's just a message that says f--k the us government and f--k

RE: Code Red

2001-08-07 Thread Boivin, Patrice J
:[EMAIL PROTECTED] -Original Message- From: Kevin Kostyszyn [SMTP:[EMAIL PROTECTED]] Sent: Tuesday, August 07, 2001 2:27 PM To: Multiple recipients of list ORACLE-L Subject:RE: Code Red Yeah, that's what I read. I had applied

RE: Code Red

2001-08-07 Thread Kevin Kostyszyn
Maritimes, MPO E-Mail: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] -Original Message- From: Kevin Kostyszyn [SMTP:[EMAIL PROTECTED]] Sent: Tuesday, August 07, 2001 2:27 PM To: Multiple recipients of list ORACLE-L Subject:RE: Code Red

RE: Code Red

2001-08-07 Thread Boivin, Patrice J
To: Multiple recipients of list ORACLE-L Subject:RE: Code Red Patrice, I have a friend downstairs who said I should use Fprot to get rid of this rogue web page, I am going to download it now. I am interested in this TDS-3 program, can

RE: Code Red

2001-08-07 Thread Kevin Kostyszyn
) -Original Message- From: Kevin Kostyszyn [SMTP:[EMAIL PROTECTED]] Sent: Tuesday, August 07, 2001 4:36 PM To: Multiple recipients of list ORACLE-L Subject:RE: Code Red Patrice, I have a friend downstairs who said I should use