Code Red 2 cleanup; reporting..

Sat Aug 11 02:59:22 UTC 2001

Valdis.Kletnieks at vt.edu wrote:
> 
> On Fri, 10 Aug 2001 02:11:21 PDT, Etaoin Shrdlu <shrdlu at deaddrop.org>  said:
> 
> > It started a service at port 80 for him (lucky guy), but he had definitely
> > not started IIS. In fact, it had that stupid default page up that I've
> > usually seen in past when some application is installed the "personal web
> > server" for an unsuspecting user. I'm a little tired, and suspect that I no
> 
> Aha.
> 
> I have been told that the *most* common reason for finding IIS on
> a non-server install of NT or W2K is that although IIS is *NOT* installed
> by default on non-server boxes, it *IS* installed if you are upgrading
> and it finds traces of 'Personal Web Server'.
> 
> Would that explain what you're seeing?

Good call. That is indeed what appears to have happened. I am still seeing
"odd" behaviour from that machine, and there are a lot of inappropriate
ports open on it (maybe explainable, maybe not). There may be an update on
monday. Since officially that machine never had a web server on it, it took
a little behind the scenes work to verify this. I feel quite relieved,
truthfully. I like the world to keep working in an explainable and rational
manner (yeah, yeah, I know, but I do).

--
Open source should be about giving away things voluntarily. When
you force someone to give you something, it's no longer giving, it's
stealing. Persons of leisurely moral growth often confuse giving with
taking.    -- Larry Wall