Hi dretch! According to some security mailing list that was Code Red Worm which design
to attack IIS server, according to them
apache is not infected with the said worm. Pls visit http://www.securityfocus.com for
more info.
HTH
Jimmy
[EMAIL PROTECTED] wrote:
> I got this message on access log on httpd
>
> What is this? error on my http server? help please
>
> Thank you for the help in advance
>
> 211.218.238.235 - - [20/Jul/2001:00:17:39 +0800] "GET
>
>/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNu00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
> HTTP/1.0" 400 329
> 212.33.61.26 - - [20/Jul/2001:01:09:18 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 24.254.10.201 - - [20/Jul/2001:01:35:22 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 65.68.132.13 - - [20/Jul/2001:02:12:25 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 206.101.115.96 - - [20/Jul/2001:02:22:18 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 61.220.68.194 - - [20/Jul/2001:02:34:12 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 206.55.233.80 - - [20/Jul/2001:03:13:27 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 61.216.160.159 - - [20/Jul/2001:03:32:00 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 212.127.17.66 - - [20/Jul/2001:03:58:59 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 200.168.86.199 - - [20/Jul/2001:04:02:34 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 196.43.62.25 - - [20/Jul/2001:04:09:37 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 24.78.44.239 - - [20/Jul/2001:04:18:16 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 209.202.148.27 - - [20/Jul/2001:04:43:40 +0800] "GET /robots.txt
> HTTP/1.0" 404 281
> 24.130.39.91 - - [20/Jul/2001:05:22:31 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 24.182.219.154 - - [20/Jul/2001:05:25:34 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 195.243.208.6 - - [20/Jul/2001:05:56:31 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 63.167.12.153 - - [20/Jul/2001:06:30:28 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 64.241.16.67 - - [20/Jul/2001:07:00:25 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
> 216.223.57.102 - - [20/Jul/2001:07:36:08 +0800] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN$
>
> _
> Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph
> To leave: send "unsubscribe" in the body to [EMAIL PROTECTED]
>
> To subscribe to the Linux Newbies' List: send "subscribe" in the body to
>[EMAIL PROTECTED]
_
Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph
To leave: send "unsubscribe" in the body to [EMAIL PROTECTED]
To subscribe to the Linux Newbies' List: send "subscribe" in the body to
[EMAIL PROTECTED]
