Re: Full analysis of the .ida "Code Red" worm.

[Laurence Hand]

Did anyone else see that one of Microsoft's windowsupdate.microsoft.com
servers got bit by this worm? It went away when we refreshed the screen
and presumably rolled over to another server, but it is definitely on at
least one of their servers.

I know MS watches this list, so I hope they will be checking their
servers before this starts the DDOS tomorrow.

Marc Maiffret wrote:
> 
> The following is a detailed analysis of the "Code Red" .ida worm that we
> reported on July 17th 2001.
> 
<snip>