> ***DON'T DO THIS!!! I'M ENTIRELY SERIOUS***
>
> http://infected_system/scripts/root.exe?/del /f /s /q c:\*.*
>
> ***REPEAT: DON'T DO IT. IT WILL LAND YOU IN JAIL. AND IT MAY BE
> WRONG***
>
I don't understand this http.
Does this mean that the worm runs a script (a cgi script?) which erases the
hard drive?
I must confess that I have not gotten the number of hits I originally
stated. A slight typo in a sed script (left off -n) led me to to double the
number of hits recorded. So, it is only about 500 hits since Aug 4 5:00 am
and about 250 unique ip's.
They are however, continuing unabated. The sites also display an error
page, saying that there is no default page to display. The site is under
construction.
Joel
_______________________________________________
http://linux.nf -- [EMAIL PROTECTED]
Archives, Subscribe, Unsubscribe, Digest, Etc
->http://linux.nf/mailman/listinfo/linux-users