I didn't get anything from Code red but I started getting about 1300 hits a
day when Nimda came out.
----- Original Message -----
From: "BubblyBabs" <eg...@bu...>
To: <sav...@li...>
Sent: Sunday, October 21, 2001 6:59 AM
Subject: Re: [Savant-discuss] Code Red?
> Yes, the Code Red worm... Don't the machines just check random IP addy's?
> I get so many CR requests that my log files are cluttered!
>
> Babs
>
> ----- Original Message -----
> From: "ederosia" <ede...@um...>
> To: <sav...@li...>
> Sent: Saturday, October 20, 2001 9:19 PM
> Subject: [Savant-discuss] Code Red?
>
>
> > [I'm a new Savant user, so you may have already answered this question
on
> > this discussion list.]
> >
> > About 10 times each day, my new Savant server receives a series of about
> 10
> > requests. They sure look like attempts to access my system for mischief
> > (e.g., "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir"). Each
> batch
> > of about 10 requests comes from different servers. Are these servers
> which
> > have been affected by the Code Red virus and are now trying to send
> commands
> > to other servers (such as mine)?
> >
> > The amazing thing is that these attempts happened immediately after I
> > installed Savant! How did they start so quickly? I don't publicize my
> > server's address.
> >
> > - Eric
> >
> > ---------------
> > Eric DeRosia, University of Michigan
> > ede...@um...
> > www.umich.edu/~ederosia
> >
> >
> > _______________________________________________
> > Savant-discuss mailing list
> > Sav...@li...
> > https://lists.sourceforge.net/lists/listinfo/savant-discuss
> >
>
>
>
> _______________________________________________
> Savant-discuss mailing list
> Sav...@li...
> https://lists.sourceforge.net/lists/listinfo/savant-discuss
|
