RE: [IMail Forum] New CodeRed like virus

[Tony Gray - System Administrator]

Yes, I think it is normal to see them there as well. (refer to the sarc.com
doc for more info)  Where you don't want to see them is places like:
c:\
d:\
c:\inetpub\wwwroot

Based on what I can list on a known uncompromised 2k server, you should see:
c:\winnt\explorer.exe
c:\winnt\system32\cmd.exe
... and copies of these (sometimes older versions) in
c:\winnt\system32\dllcache, and possibly in
c:\winnt\$NtServicePackUninstall$ (if you chose to backup files during
service pack installation)

You should not see a copy of root.exe anywhere.  The sarc.com doc does a
better job then myself of explaining what you would see if you've been
comprimised.

Basically, from what I've read so far, the trojan tries to:
- copy cmd.exe (usually renaming it to root.exe) to another place where it
could easily execute it via http
- creates a bogus explorer.exe in c:\, which is in charge of contantly
adding virtual directories to allow an http user access to the root.exe
- when done essentially allows anyone with http access to your server to run
most anything against cmd.exe that they could only normally run from the
console.

Hope this helps explain,
Tony

-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Tim
Sent: Tuesday, August 07, 2001 5:14 PM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] New CodeRed like virus


How about c:\winnt\system32 and c:\winnt\dllcache ???

Can they be in those directories ?

Tim D


-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Tony Gray - System
Administrator
Sent: Tuesday, August 07, 2001 3:27 PM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] New CodeRed like virus

Do a filesystem search for:
explorer.exe
root.exe
cmd.exe

See if you find any in a folder other than C:\winnt\  Finding them in other
locations indicates that Code Red II might have hit your machine.  See:
http://www.sarc.com/avcenter/venc/data/codered.v3.html

- Tony

-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Domain
Administrator
Sent: Tuesday, August 07, 2001 11:51 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] New CodeRed like virus


I am having the EXACT same problems... and I KNOW I have the patch on ALL my
servers.

I have noticed that the "CodeRed" attack IS different this time...

Last time it was: GET /default.ida NNNNNNN...

This time it is: GET /default.ida XXXXXXXX...

Sure would like to figure it out!


----- Original Message -----
From: "Steve Polyak" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, August 06, 2001 3:37 PM
Subject: [IMail Forum] New CodeRed like virus


> Has anyone been running into what seems to be a CodeRed Virus.  I have my
> IIS web services stopping anywhere from a minute to an hour after reboot.
> FTP services seem to be unaffected.  I have the patches installed from
> Microsoft since the last attack and have installed it a number of times
> since.  I have tested the server using the CodeRed test from Norton and it
> says everything is ok.  I do see the new Code Red getting logged into my
log
> files as GET /default.ida XXXXXXXX and so forth but the server does not
> really seem to crash.  But when I try to restart the computer or restart
web
> services the Events log says     Also I have noticed that sometimes when
> Inetinfo.exe Dr. Watson's the computer with blue screen and reboot.  Also
> sometimes I will see my SQL 7 server which is on the same machine become
> busy.  I have the latest Norton installed and up to date and also have now
> install IIS Secure and the problem still occurs.  It only started on
Friday
> like this and I am running out of ideas.  Anyone else been having the same
> problem?  I have had one server do it a couple time in the last couple
days
> and it did run SQL 7 at one point.  The other servers seem to be fine.
>
> Thanks
>
> Steve
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>


Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/


Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/






_______________________________________________________________
Sent using Novelty Mail the FREE EMAIL SERVICE. Click here
http://noveltymail.com to get your own free email using this or ANY of our
fun domain names.

Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/