[Xitami] Another CodeRed solution...

[Jeff Hamblin]

----- Original Message -----
From: "Thomas J. Hruska" <shinelight@crosswinds.net>
> The net send command
> won't work on 95/98(/ME?) machines, but will work on NT/2K with CR
> II...which should be fine since those are the machines that are most
likely
> to still be infected.
>

I'm pretty sure only NT and 2000, running an unpatched IIS, are vulnerable
to Code Red.

During the first few days of the CRII onslaught, I'd take a few minutes a
day and plug the IP addresses of infected machines (gleaned from my xitami
error logs) into my web browser. If a website loaded, and there were any
contact email addresses available, I sent them a note about their 'problem.'
I actually got a few thank you's. The 'fun' wore off rather quickly. The
Code Red Vigilante approach is much more efficient.

Something interesting to note is a debate currently on the @home tech
support newsgroups. As many know, the terms of service for @home 'forbid'
users operating web servers. What's interesting is that the @home user
webpages support MS Frontpage extensions, and @home recommends that users
use Frontpage 2000 to create and maintain their @home website. Installing
Frontpage 2000 installs IIS on the local machine to host the local copy of
the website (for previewing I presume). Many users don't realize they have a
web server running!! They're just following the recommendation of their ISP!

I know this is a bit off-topic. But everybody seems to be tired of their
logs filling up. I'm still getting about 20 CRII hits an hour. I'm not so
much concerned about that in itself. I'm concerned about what's going to
happen when all these infected machines that have a wide-open backdoor start
getting exploited.

What I am REALLY concerned about is ISPs using this as an excuse to block
port 80. AT&T has already done it. I expect more will follow suit.

-Jeff H