RE: [cobalt-users] Code Red

[Dom Latter <DLatter@xxxxxxxxxxxxxxx>]

> Even better would be to log the IP address, do a dig on the results 
> and send an abusive message to the administrator of the site it 
> resolves to (if available) or the admin for the IP block.

That would be Unsolicited Bulk Email.  Don't do it.

However, you are always free to do the above "manually", as I
did yesterday.  After I got a reply saying "thanks, we've now
installed the MS patch" I thought I'd check to see if the Trojan 
had been removed.

So I sent him the output of a command and said "good thing it 
was "dir" and not "format C:".

Do you think he changed his trousers *before* or *after* 
removing the Trojan?