[Xitami] CodeRed solution...

[Michael]

On 10 Aug 2001, at 2:55, Thomas J. Hruska wrote:

> >From what I can tell, most people now have CodeRed II (my log files for
> >the
> past 24 hours only show CodeRed II).  So, here is what we can do to help
> the poor souls out :)
> 
> Write a PHP script called default.ida.  Now, instead of replying with an
> e-mail (as someone suggested), make the script take advantage of the fact
> that cmd.exe is now in an executable location on the remote server (as
> root.exe).  So, what the script should do is execute root.exe to launch FTP
> to go and download the patch from Microsoft.  Then, use root.exe to FTP
> down a macro script from your sever (to simulate keypresses).  Then run the
> macro script on the remote server using root.exe one last time to execute
> the macro script which will install the patch (the macro script should also
> remove root.exe as well as reboot the machine when it's done).  Thus, we
> can effectively remove CodeRed II on the remote server and patch IIS at the
> same time...Microsoft never made fixes this simple :)
> 
> 
>            Thomas J. Hruska -- shinelight@crosswinds.net
> Shining Light Productions -- "Meeting the needs of fellow programmers"
>                   http://www.shininglightpro.com/
> 
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami


Have you pondered the legality of modifying someone else's computer 
without their consent?   Wouldn't you be suspect for damages, real or 
imagined?  

Some people are going to be really po'd when they discover they have to 
reformat everything on their local network.  As very few good deeds go 
unpunished, I don't think I want them looking in my direction.  

Also, I don't see that you've removed the backdoor or other backdoors 
that may have also arrived.  Would you further help these people by 
reformatting their computer remotely?  Surely you realize that hackers 
are applying their own automated routines but for other purposes?

The people to help is Microsoft.  At first I thought that everyone should 
relay all these gazillions of daily hits to them so they will learn to be 
more responsible than to default bug-ridden internet software in the next 
os.   On second thought I suspect that giant armies of slaved machines 
are probably getting ready to do just  that ~ and worse.

Michael