RE: Code Red 2 cleanup; reporting..

[HTML formatting removed]
I should have been more clear [comments about nit-picky bit-heads, removed].

Win2K Active Directory clients run some parts of IIS, in order to support
Active Directory. Even if, you never installed IIS explicitly. Especially,
there is some serious LDAP/IIS integration here. Note the option to share a
directory on the web, how do you think that happens? Also note that, users
very often don't understand the difference between SMB file sharing and Web
Sharing and Win2K goes to great lengths to obfuscate those two anyway.

Win2K is a major re-write of the Domain Controller and its clients. Expect
large bugs, roaches the size of small dogs. MSFT [lack of] design QA is well
known. If you've never built large software systems, you'd not know that you
can integration-test the hell out of one [large software system] and still
never catch design flaws because it all meets specification. It is the
specifications that are wrong. The exploit that CodeRed uses is a classic
example. The only thing that works there is remorseless/ruthless high-level
architectural peer review. MSFT doesn't do those. They replace that process
with a bazillion integration testers.

Note the option to share a directory on the web, how do you think that
happens? Also note that, users very often don't understand the

difference

between SMB file sharing and Web Sharing and Win2K goes to great

lengths

to obfuscate those two anyway.

This particular example implies that file-and-print sharing has to be
installed. This is off by default for my boxes. Other ways to get it
installed are to run the IIS service, the FTP service, or one of the
other related services (SMTP, NNTP).

IOW, it's not installed without installing one of the related services.
I've got several Win2k Pro boxes and none of them have IIS running. They
do have the program in the ServicePackFiles directory, but its not
installed or running.

You can find out it if its running by looking for inetinfo.exe (the IIS
proggy) in the services tab in taskmgr.exe. You can find out if it's
installed by searching for inetinfo.exe on your hard drive.

"Eric A. Hall" <ehall@ehsco.com> writes:

  You can find out it if its running by looking for inetinfo.exe (the
IIS proggy) in the services tab in taskmgr.exe. You can find out if
it's installed by searching for inetinfo.exe on your hard drive.

Eric,

    Where would it be installed? How big would it be?

    I checked my W2k box and it isn't running - nor have I ever seen it
  running - but it is found on my hard drive:

    D:\WINNT\system32\dllcache\inetinfo.exe
    D:\WINNT\$NtServicePackUninstall$\inetinfo.exe
    D:\WINNT\ServicePackFiles\i386\inetinfo.exe

    They're all 15 KB...

-jon