Re: The Return of Code Red II?

[Roger Thompson <rthompson111 () sprintpcs com>]

At 11:24 AM 3/11/2003 -0600, you wrote:

> Is anyone else seeing traffic generated by Code Red II.  I thought it 
> wasn't supposed to propagate after 10/01?  Unfortunately I don't have the 
> whole string but here is the RealSecure Event.

Yeah. It's two bytes different. The two bytes control the 'stop' year. This 
one won't ever stop, although it will still take a vacation from October to 
December each year. I'm calling it CodeRed.F.

See... www.wormwatch.org

Roger





Regards

Roger Thompson
Technical Director of Malicious Code Research
TruSecure Corporation
www.trusecure.com
www.wormwatch.org


----------------------------------------------------------------------------

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure";> http://www.securityfocus.com/stillsecure </A>