Code Red 2 cleanup; reporting..

Fri Aug 10 14:51:34 UTC 2001

On Fri, 10 Aug 2001 02:11:21 PDT, Etaoin Shrdlu <shrdlu at deaddrop.org>  said:

> It started a service at port 80 for him (lucky guy), but he had definitely
> not started IIS. In fact, it had that stupid default page up that I've
> usually seen in past when some application is installed the "personal web
> server" for an unsuspecting user. I'm a little tired, and suspect that I no

Aha.

I have been told that the *most* common reason for finding IIS on
a non-server install of NT or W2K is that although IIS is *NOT* installed
by default on non-server boxes, it *IS* installed if you are upgrading
and it finds traces of 'Personal Web Server'.

Would that explain what you're seeing?
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 211 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20010810/02f361fc/attachment.sig>