Code Red 2 cleanup; reporting..

Sat Aug 11 20:29:19 UTC 2001

> >on a firewall to a server supposedly only running
> >the latest CITRIX on Port 80 (why 80? Don't ask me?)
> >and the high paid out of town consultants swearing they

> I've seen a report that the patch is not fully effective -- see 
> http://archives.neohapsis.com/archives/incidents/2001-08/0218.html.

Turns out that because they had not installed IIS, they did not patch the
system....

Then when they installed Citrix, it installed IIS. 

After looking around, it seems a LOT of 'other' software
installs IIS when no-one is looking.