Ida /code red worm veriation

Jay D. Flanagan jflanag at
Fri Jul 20 14:57:07 GMT 2001

As others have, several of our IIS servers have been hit with what we think is a variation of the ida /code red worm. 

Some of the characteristics we are seeing are our web servers stopping and starting multiple times and no physical traces were found.

Some differences between the attack on our web servers and the code red worm  include that our web servers were brought down and the default web page was not defaced. 

Has anyone seem similar situations with their web servers and if so, what actions did you take to correct the problem? We have installed the Microsoft patch, but it seems to not have stopped any of our problems.

Thanks in advance for any help you can give us!

Jay D. Flanagan
Security Administrator 
Emory University
Email: jflanag at
Phone: 404-727-4962
Fax: 404-727-0817

More information about the unisog mailing list