Code Red 2 cleanup; reporting..

Fri Aug 10 05:12:38 UTC 2001

> Spent nearly two days convincing someone who was managing a server that he
> was beating up machines all over the company. It finally took someone at

Tonight, 20 minutes after openning up port 80
on a firewall to a server supposedly only running
the latest CITRIX on Port 80 (why 80? Don't ask me?)
and the high paid out of town consultants swearing they
had applied the appropriate patches and were safe, 
they are now broadcasting out the latest CodeRed style worm.

I got some nice sniffit captures from my Linux firewall
though.. this morning will be interesting. I wonder
how they like their crow served.