On Mon, Aug 06, 2001 at 01:18:56AM +1200, Steve Phillips wrote: so how hard would it be to write a cleaning agent ? not hard -- it's just a matter of time :) have it download an exectuable form a know location and execute it... that executable could then apply relevant patches and reboot (since you have to write and exectable, may as well put the hard logic in there) even if it were a "shutdown server and leave a message 'you have been hacked, please patch your machine' " on their screen ? and get sued :) from the number of hits I am getting from korean/asian IP's it may pay for some clever cookie (joe could write it in AWK ?) to put the message in catonese/mandarin as well :) Nah, China officially said they weren't infected. You must be wrong :) There was a break down of infected hosts by AS last time, I expect we'll see another soon, I think 4648 and 4768 were the two worst affected ASs in NZ, about 20 odd hosts in the former and under 10 in the latter, eveyone else was single figures. Since, I assume, most NZ web-servers were set to a locale other than US English, presumably very few were defaced and went undetected for some time. --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog