Not a guarantee by any means but I found this somewhere and it looks like it might help with code red stuff. Just add into any 404 page that you have.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <% 'Custom404.asp page to thwart Nimda DoS attacks on IIS 'by Humankind Systems, Inc. http://hksi.net/ 'No support or guarantees of any kind are granted with this 'code. Use at your own risk. Distribute freely. 'Get the entire URL requested myRequest=Request.ServerVariables("QUERY_STRING") 'A list of filenames Nimda looks for myBadList="cmd.exe,root.exe,admin.dll,default.ida" 'Detect a GET request from the Nimda virus and take appropriate action arrBadString=Split(myBadList,",") for i=0 to UBound(arrBadString) if inStr(myRequest,arrBadString(i))>0 then 'turn offending server back on itself Response.redirect "http://127.0.0.1"; end if next %> If you're running any cisco routers at your border I know there are some ACL list setup's for this too that effectively blocks nimda stuff. ~Rick ----- Original Message ----- From: "Paul Navarre" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, November 23, 2002 10:25 PM Subject: RE: [IMail Forum] Fw: Having USERID of 2 characters > MessageWe had the problems with versions 3 and 4. I understand they are now > up to version 5 but we bailed before they got to 5. > > One thing you might try. We have our Web Messaging set up on port 8383, but > we use GDataPipe to redirect so port 80 works too. The reason we do this is > that we used to have web messaging only on port 8383, but as Imail is now on > its own server, we want clients to be able to get it without appending a > port. This way, long-time clients don't have to unlearn 8383, and new > clients can log on using just http://mail.domain.com. Someone who knows > more about Code Red might be able to comment on whether this arrangement > provides any protection, but for what it is worth I haven't had a web > messaging issue since we set it up this way. > > Paul > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Mark McDonald > Sent: Saturday, November 23, 2002 7:24 PM > To: [EMAIL PROTECTED] > Subject: RE: [IMail Forum] Fw: Having USERID of 2 characters > > > Hi Paul, > > What version of MailMax were you using? We're considering "ditching" > IMail for the same reason you left Mailmax, IPSwitch essentially told us we > cannot fix the web messaging issues we're having without moving the service > off port 80 (which doesn't work for our company needs). I just wish > IPSwitch stated that the Web Messaging service is for INTRANet's and not the > internet. > > -Mark > > ___________________________________________________________________ Virus Scanned and Filtered by http://www.FamHost.com E-Mail System. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
