Code Red Worm-what the hell?

Normally, I wouldn’t ask this, but I’m extremely confused…

First off, I want to know-is Windows ME the same as Windows 2000?

2nd-does reboot mean restart my computer, or reformat my harddrive?

3rd-is this all a stupid hoax?

(sorry, my mother is telling me about it, and I’m very frightened at the idea of ANYTHING happening to my precious computer…)

  1. ME, 2000, close enough.

  2. Reboot means to restart.

  3. It’s no hoax. Here’s a good article from Wired: http://www.wired.com/news/technology/0,1282,45681,00.html
    Note that only some machines are vulnerable, and that it’s aimed at servers, not Bob’s laptop.

  1. No. Win’98 is based upon Win’95, which is based upon MS-DOS. Win2000 is based upon WinNT.

  2. Restart. Two choices: “Warm boot” (“Soft Boot”); select {Start | Shut Down | restart} -or- “Cold Boot” (“Hard Boot”); Shut down, power-off, then power-on.

  3. No hoax, but unless you’re running an Internet Information Server on WinNT or Win2000, or own a Cisco router, you’ve got little to worry about.

Link

BTW, TechNet has moved the page you linked to.

Not as clear as I intended: ME is Win’98 Millenium Edition, which comes from the DOS branch of the MS family. Win2000 Is based upon Windows New Technology, written by a bunch of OpenVMS programmers hired by M$.

ME is probably even more safe than 98… it doesn’t include Personal Web Server.

Until about a week ago, that pissed me off.

Thanks to Red Alert, though, having an OS that doesn’t do diddly suddenly has its advantages.

Whew. Thanks.

Sorry to clog up GQ, it’s just that despite the fact that I spend 99.9% of my time on this thing, I know little about it’s inner workings, and I’m EXTREMELY overprotective of my beautiful computer.

Forgot to add-Manny, feel free to close this.

No hoax whatsoever.

I’ve been down for the past three+ weeks courtesy of the Code Red Worm as you will read about here.

I want to be pissed a Qwest, my ISP, but they really are just a bunch of clueless wackoffs. It’s not their fault that they have a multi-million-dollar contract with Cisco that they are undoubtedly dreading as of late.
[list]
[li]I own a Cisco router.[/li]
[li] I am using ME/2000[/li]
[li] I have been up sht creek for three weeks and Qwest is still running me in circles whenever I call tech support, now trying to convince me that I have done something wrong. :rolleyes:[/li]
Thanks for reminding me how f
cked I am right now. :smiley:

The Code Red worm is targeted to M$ IIS servers that don’t have the latest security patches. One area of vulnerability that (almost) no one thought of is the Cisco gear: that easy-to-use HTML interface is actually a firmware copy of IIS. Cisco has a security bulletin on it, but I don’t have the URL here at home.

Another oxymoron: Microsoft security.

The home user has nothing to worry about. It only affects people running web servers (and Microsoft’s Personal Web Server doesn’t count).

While the virus is not a hoax, the hysteria is way out of line. This virus is only of a concern to people who run websites. It’s also an easy fix (add the patch and reboot). The media has been disgustingly irresponsible on this one.

It’s sort of like having doctors warn people about a major outbreak of Ick (a disease of tropical fish).

I am currently not running a web server and I have been without my high-speed DSL service for the past three weeks. Any ideas?

How hysterical would you be if you were forced to use a 56k with a dial-up every Goddamn day for three weeks straight, after having a 600+ kbs at your disposal for the past three years? Hey pal, any links to the website with the patch?

It’s a little bit different than that, and a remedy/panacea is not quite as readily available as you have described. Trust me, I have spoken with the tech support for my ISP, conducted multiple ping tests, and results conclude that my ISP(I cannot speak for the others) is definitely experiencing internal difficulties. My router consistently sends positive pings to the intermediary routers and shows that all is well at my terminal. Now I am simply waiting for the dumbasses at Qwest to discover that there is nothing wrong with my setup and to get their shit into working order.

FWIW, it’s certainly not every Cisco router that’s vulnerable to the Red Worm - the only vulnerable systems are (unpatched) DSL routers in the Cisco 600 series.

And it’s not as if they propagate the worm, it’s simply an old and well-known bug in the 600 router’s configuration interface that coincidentally gets triggered by the Red Worm scanning. But 600 routers are odd birds anyway, they’re not part of the general Cisco lineup (800-12000 routers) - specifically, they don’t run the IOS operating system.

The other affected Cisco products are software products (mainly management software) running on MS IIS or modified versions thereof.

Yeah, I know, noone asked.

S. Norman

wishbone, I think you need to lighten up a bit…yeesh, that kind of attitude will pop a blood vessel in your eye or in your neck.

Here’s the official email from Microsoft that I received this evening:

BTW I added the information that is not really needed to show that’s it’s an official email and I added a bolding to emphasis that YOUR problem with Qwest is most likely not due to this but problems that you have not divuldged to a degree that many of the well informed techs on this board can help you with.

I have a problem with people that automatically blame their ISP or Microsoft for their problems without considering that it’s possible there are other fixes to your problem.

If you so choose, then post another thread to detail, yes great detail, the problem you are having. Qwest may be the problem but in this case, from the little bit of information you gave us, it’s NOT the problem of this current virus outbreak.

Oh and I kind of feel that this virus/worm is pretty harmless…there’s an easy fix, there’s little damage so it’s pretty mild compared to some of the other viruses I have had to deal with in the past.

[bold]wishbone[/bold], even assuming your trouble was caused by the worm (and it may have nothing to do with it), my advice still stands. Your computer isn’t affected. It’s your ISP’s. Now, maybe they don’t have their act together and are total incompetents, but they’d be that way even if the virus doesn’t exist.

BTW, if you’ve been having this problem for three weeks straight – as you say – it can’t be the virus. Code Red was discovered on July 16th – only two weeks ago.

<unison> Awww. Poor Baby.</unison> I do use at 56k dial-up.

Once again, windows ME (Millenium) is NOT 2000 based. It is more or less immune to this virus, just as 95/98/98SE are.

I am curious if XP is immune though.

That being said, it is a very real threat from everything I have read and has some real potential to screw up the net for the next while. The SDMB may be “speedy” in comparison to some other sites. :slight_smile:

WinXP-based servers running IIS should also be vulnerable.

I dunno…I’m using WinXP build 2505 and IIS, and I don’t see any critical updates to address this worm. I take that to mean that M$ has already compiled that patch into their beta builds.

From Sophos:

From Microsoft:

and

There is some significant misinformation in this thread. As Spiny Norman already pointed out, select Cisco routers are affected by the worm. Affected != infected. They are simply knocked offline. The problem is with the router. Don’t believe me? Believe the folks at Cisco (by way of Security Focus [Sorry, can’t link directly to the article – go to vulnerabilities, Cisco, 2001]):

The whole Code Red debacle is really quite interesting. The buffer overrun vulnerability was pointed out on Bugtraq, and a patch was quickly enacted. The problem was, too few people applied the patch. They had several weeks. So first it was widespread stupidity by sysadmins. But then, the worm’s coder had some stupidity issues too. The worm’s scan of other computers was random, but it used the same seed, and thus (since it can’t be truly random), it began to repeat scans. Furthermore, he hardcoded the IP address of the target of his attack (whitehouse.gov), and the White House folks very slickly changed their IP, thus dodging the entire attack.

There is a wealth of information on the virus, ranging from analysis of disassembled code to basic information to analysis of the virus’s spread. (Parenthetical note: Don’t believe a word from Steve Gibson’s mouth about this virus.) Have some links:

Code Red Spread Analysis

(older)

(newer)
More Articles Than You Could Ever Possibly Want

Au contraire, mon frere. The quality of service I received from Qwest was outstanding from day one. They were perfectly competent in every way. It was only three weeks ago TODAY that my computer started buggin’ out.

I don’t know whether the Red Worm was the official reason that my DSL quit working exactly three weeks ago today, but I think it would be foolish to think it was something else, considering that it(my DSL) has run perfectly 24-7 for the past three years.

<unison> Awww. Poor Baby.</unison> I do use at 56k dial-up. **
[/QUOTE]

Then you understand what a pain in the ass inconvenience. It’s like being stuck in rush hour traffic.