On Fri, Aug 03, 2001 at 12:29:05AM -0500, ktb wrote: > From what little I have read about it the site in question is defaced > if it is a page containing English. I'm sure someone who has payed more > attention could list exactly what it does.
After infecting a system with U.S. English as the default language, one of the code red threads will go dormant for 2 hours, insert a handler which causes any requested URI to return the 'hacked by Chinese' page, wait 10 hours, and remove the handler. Thus, you will only see defacement on machines that have been infected for more than 2 and less than 12 hours. -- With the arrest of Dimitry Sklyarov it has become apparent that it is not safe for non US software engineers to visit the United States. - Alan Cox "To prevent unauthorized reading..." - Adobe eBook reader license