Case Study:  CRClean7
•Code Released 9/1/2001 Written by Markus Kem
•Code Red Response: Listens, Disinfects, Patches
•
•Listens for CodeRed to attack it
•Exploits ISAPI vuln on CodeRed attackers
•Removes CodeRed from system
•Patches ISAPI vuln on system
•Installs itself on system
•
•
–
–