[thelist] failure notice (& CF TIP)
Steve Cook
steve.cook at evitbe.com
Wed Sep 19 09:59:57 CDT 2001
Hmmm! Curious. There's not even an open port 80 on our firewall. The server
is on our internal network - it's a development server with NO inward
connection to the Internet.
*wonders how that got there*
It could *possibly* have come from within our service prover's network, but
that's all I can think of.
Oh well. I'll check it out. Thanks for the heads-up!
----------------------------------
WapWarp - http://wapwarp.com
Wap-Dev - http://www.wap-dev.net
Cookstour - http://cookstour.org
----------------------------------
> -----Original Message-----
> From: Daniel J. Cody [mailto:djc at starkmedia.com]
> Sent: den 19 september 2001 16:35
> To: thelist at lists.evolt.org
> Subject: Re: [thelist] failure notice (& CF TIP)
>
>
> Hey Steve -
>
> Steve Cook wrote:
>
> > Hi Dan!
> >
> > If one has that file, does it mean that the server *has*
> been infected by a
> > worm, or is it that the file is a security loophole?
>
>
> root.exe is a by-product of the code red series, so its presence
> suggests that your server *was* infected at one time.
>
More information about the thelist
mailing list