Were these code red 1, or 2 infected hosts. Do you have cmd.exe laying anywhere public? Jason -- Jason Slagle - CCNP - CCDP Network Administrator - Toledo Internet Access - Toledo Ohio - raistlin@tacorp.net - jslagle@toledolink.com - WHOIS JS10172 /"\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \ / ASCII Ribbon Campaign . Interim Team Lead - . Admin - X - NO HTML/RTF in e-mail . Coders . wombat.dal.net / \ - NO Word docs in e-mail . Team Lead - Exploits . DALnet IRC Network On Mon, 20 Aug 2001, mike harrison wrote:
starting saturday night, i noticed that snmp queries were failing to one or both of the routers at various points.
Saturday Night... Code Red I infected machines started flood pinging 65.161.40.42 and 65.161.40.142 Could this have contributed to the wierdness?