Code Red v.2

[pm]

I've started seeing what I was calling "Code Red TNG" (the next generation), but what Slashdot is calling "Code Red v2.0" showing up on my scanners tonight.

It looks like this:


<< [03/Aug/2001:18:32:37 -0800] &quot;GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a%20 HTTP/1.0&quot; 404 -1 &quot;&quot; &quot;&quot; >>



I've tracked about a dozen of these starting at 6pm (MST) this evening. Note the &quot;X&quot;'s instead of the &quot;N&quot;'s used by &quot;Code Red v1.0&quot;. I'm patched, and running a different webserver anyway (no IIS for me, thank you very much), so I don't worry much, but it's a bit disconcerting to actually watch a virus/worm probing my shields. I sit there and think &quot;Hah! You can't touch me&quot; but in the back of my mind I wonder &quot;You can't, can you?&quot;.

 

[Orange Kid]

Any ideas as to what TNG is up too?
Seems to still be going.
There's a thread here about it too.

 

[Poof]

My Apache logs have both the &quot;N&quot; and &quot;X&quot; forms. Most started in earnest ~9am EDT yesterday morning (8/4) and have been going crazy all this morning.

Code Red! Blech.

Apache rules! 😛

😉

 

[Paulson]

I have both N and X's in my logs!

Damn...

 

[Poof]

Paulson, et al - here is a site talking about Code Red II (got pointed to Slashdot from another thread here, where they began reporting on it). This thing looks a bit nasty because it can go through NAT firewalls to IIS's running internally (via port-forwarding), and then will start scanning and infecting any &quot;local&quot; and/or &quot;reserved address space&quot; machines.

Sigh. When will M$ get the message?

 

[todays]

It started with mine yesterday morning also. I have been probed about every 3-4 minutes continuously since. Non stop! My log is going wild.

 

[Paulson]

poof, does that mean my system is infected or what? 🙁

 

[Poof]

Oh baby.... 🙁

You better take your machine off temporarily and check for it. There are at least 2 variants
out in the wild now. These last 2 came out in the past 36 hours or so. 🙁

[EDIT: Check here for more info]

 

[Paulson]

how do I check for it?

I'll shut down paulsonator.com at the moment...

DAMN. Microsoft blows 🙁

 

[Poof]

Paulson - I haven't been paying much attention to it until now, but go through this FAQ. It has links to all the places you need to go to fix your IIS. 🙂

 

[Paulson]

I don't know if the patch was installed or not?

How do I tell if it would be running on my machine... all I need to knwo 😉

Thanks though

 

[Poof]

At this point, if you don't know if it is on there or not, it probably isn't. 😉 Just apply it. If it complains, then it should abort. 🙂