Nate Straz <nate at techie.com> wrote: > > BTW, AT&T updated their Code Red help page. > > http://help.broadband.att.com/faq.jsp?content_id=792&category_id=54 Interesting. Looking at the Q&As on that page, it doesn't appear that running services is explicitly denied. They're just responding to the fact that this worm can ``interfere with the ability of any other person to use or enjoy the AT&T Equipment or the Service.'' Then again, they may explicitly state it elsewhere. Anyway, here's what I've done on my own system (not on a cable modem): Add `.ida' to the PHP mime/type in httpd.conf AddType application/x-httpd-php .php .php4 .ida and created a file named `default.ida' that attempts to connect back to CR2-infected systems and pop up a warning with the `net send' command. Of course, I have no way to test it. http://www.tc.umn.edu/~hick0088/files/defaultida.txt -- _ _ _ _ _ ___ _ _ _ ___ _ _ __ The sooner you fall / \/ \(_)| ' // ._\ / - \(_)/ ./| ' /(__ behind, the more time \_||_/|_||_|_\\___/ \_-_/|_|\__\|_|_\ __) you'll have to catch up. [ Mike Hicks | http://umn.edu/~hick0088/ | mailto:hick0088 at tc.umn.edu ] -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 232 bytes Desc: not available Url : http://shadowknight.real-time.com/pipermail/tclug-list/attachments/20010809/c1b568a7/attachment.pgp