Background CodeRedII Copies cmd.exe to /scripts/root.exe and /msadc/root.exe Creates virtual web path for C: as /c and D: as /d Nimda Enables sharing of C: drive as C$ Creates Guest (Administrator) account on NT/2000 Simple browser-based attack http://server/scripts/foo/..%C1%9C..%C1%9C..%C1%9C winnt/system32/cmd.exe?/c+ping+-n+65000+-l+64000+-w+5+victim