> >> I ran three all-files virus checks, on top of the on-access
> >> scan, since having this problem
>
> I am puzzled by this statement. I don't believe that there
> is anything to "find" for the worm except for maybe some
> registry entries. The first changed your webpage and I could
> see something catching that, but not an anti-virus. The
> third put a root.exe and maybe the anti-virus companies are
> looking for that now. However, I would rely on anti-virus to
> protect me from a Worm. You shut the door.
Well, I ran the virus checks on the assumption that "a" virus, not necessarily Code Red, may be causing this problem and I just wanted to cover my bases.
> >> I've rebooted twice (which should have taken care of
> >> Code Red if it had been an issue)
>
> No, only if you run the patch and then reboot.
I was under the impression that Code Red is memory resident, henceforth gone after a reboot (I know if I can be infected once, I can be infected twice), or is the latest variant saved to disk ?
> You are asking for help here and the best advice that I think
> any of us could give you is to first get up to date. Even if
> we are wrong and it isn't Code Red, there is still a real
> good chance that the SPs and HFs could help here. If I had
> to guess if you called PSS, that is where they would take you
> first also.
Well, I have a patch party planned for tonight between 3 and 5 am, complete with freshly baked croissants and Starbucks hot chocolate for breakfast (come one and come all). What did the trick with the no-patch higher up is the fact that Exchange has markedly slowed down the past few hours (it takes a full minute for my Outlook to open whereas it used to take only a few seconds) and complaints are starting to pile up. The *hope* is fixing IIS will somehow fix Exchange... Stand by for a report tomorrow morning.
Thanks for everyone's help so far. Hopefully I won't need it anymore tomorrow... :-)
Eric Peeters
Network Administrator
TexLoc Ltd
