 |
 |
If this is an IIS server and was previously infected with CodeRed, it can still be hacked into even if the patches are current. Look for root.exe in the inetpub\scripts directory. Symantec's site has removal instructions if that's your problem. >>> [log in to unmask] 11/01/01 03:11PM >>> Very frustrating. bard.cal.msu.edu is my box. It was hit by nimda in september. It was formatted and reloaded from a sept 8 backup, fully patched according to microsoft downloads and yet it has been exploited again. I am obviously missing something but I don't know what. I had noticed unusual activity and had the box off the wire before Gene's email went out. I was probed by 210.178.12.111 and 35.8.195.55 but my log shows 404's so I don't know how the heck they got in. Any help in buttoning this up would be much appreciated. Michael Hoxsey Network Admin Arts and Letters