Re: Code Red III

[Ryan Russell <ryan () securityfocus com>]

On Tue, 14 Aug 2001, Tim Bogart wrote:

> Has anybody developed a signature for Code Red III yet?

There has been no verification that there is a Code Red III.  That is to
say, I believe that it is another name for CodeRed II, the flavor that
leaves the root.exe and explorer.exe backdoors, the third Code Red flavor
that has been publically discussed.  (NIPC says they have another
variant, I haven't seen it.)

Existing snort rules will catch all of the existing Code Red worms.

                                        Ryan



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users