RE: Code Red

Yeah, that's what I read. I had applied the patch and I don't have Code red or Code Red II, however it appears that I have something else. It doesn't seem to have worked but it looks like someone tried to deface our website. It's just a message that says "f--k the us government and f--k poisonbox", not sure what to do with it yet.
KK

-----Original Message-----
Brian
Sent: Tuesday, August 07, 2001 12:56 PM
To: Multiple recipients of list ORACLE-L

The worm is just memory resident, so a reboot should get rid of it, BUT without the patch, you'll get it right back.

The problem for the new version is it deposits a trojan backdoor on your server.
Mcafee dat 4152 is supposed to find the trojan, I'm sure other virus scanners are releasing versions also. Check with your anti-virus site.

> -----Original Message-----
> From: Kevin Kostyszyn [mailto:kevin_at_dulcian.com]
> Sent: Tuesday, August 07, 2001 11:56 AM
> To: Multiple recipients of list ORACLE-L
> Subject: Code Red
>
>
> So does anyone know how to get rid of the virus if you got it?
>
> Sincerely,
> Kevin Kostyszyn
> DBA
> Dulcian, Inc
> www.dulcian.com
> kevin_at_dulcian.com
>
> --
> Please see the official ORACLE-L FAQ: http://www.orafaq.com
> --
> Author: Kevin Kostyszyn
> INET: kevin_at_dulcian.com
>
> Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
> San Diego, California -- Public Internet access / Mailing Lists
> --------------------------------------------------------------------
> To REMOVE yourself from this mailing list, send an E-Mail message
> to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
> the message BODY, include a line containing: UNSUB ORACLE-L
> (or the name of mailing list you want to be removed from). You may
> also send the HELP command for other information (like subscribing).
>

--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author: Anderson, Brian
  INET: andersob_at_mail.dartnet.peachnet.edu

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.com
-- 
Author: Kevin Kostyszyn
  INET: kevin_at_dulcian.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).