Re: [expert] The CodeRedWorm mystery

2001-08-30 Thread Expert
Can I add that anywhere in that file? One place I put it, it had an error when restarting httpd, so I just guessed and put it anyplace that it did not error. I hope I'm doing it correctly, please advise. Thanks On Thursday 16 August 2001 03:54 am, so spoke Gabriel Fortuna: Hey Guys 2) Then

Re: [expert] The CodeRedWorm mystery

2001-08-29 Thread Praedor
Nice. If only I could get it onto my cisco 675 and make IT us it... In any case, I do not run a webserver (the cisco can - though it is shut off as a result of the CodeRed traffic). I am totally unfamiliar with webserver stuff. What language is this? Ruby? Perl? PHP? Something else? On

Re: [expert] The CodeRedWorm mystery

2001-08-29 Thread Digital Wokan
The lynx-source part is just a command being issued to the IIS server though the backdoor installed by CR2. The .ida file you're creating is just a server side include telling the server to run that lynx-souce command. On Wednesday 29 August 2001 06:10, you wrote: Nice. If only I could get

Re: [expert] The CodeRedWorm mystery

2001-08-28 Thread Expert
What does happen? On Thursday 16 August 2001 03:54 am, so spoke Gabriel Fortuna: Yeah, I suppose it's quite cool to brag about the number of CodeRed hits we get, what about doing something (de)constructive about this menace... I found this gem on Linuxbrit.co.uk... I think. 1) Create a

Re: [expert] The CodeRedWorm mystery

2001-08-16 Thread cb
How many have you had? According to my logs, as of right now, I've got 897. (This would be a fun competition! -- who's got the most default.ida hits?) Cheers, -Charlie On Wed 15 Aug at 21:07:30 -0500 [EMAIL PROTECTED] done said: I wonder when this worm is going to finally die? Keeps

Re: [expert] The CodeRedWorm mystery

2001-08-16 Thread Jan Dittberner
[EMAIL PROTECTED] schrieb: How many have you had? According to my logs, as of right now, I've got 897. (This would be a fun competition! -- who's got the most default.ida hits?) had more than 8 in 1 week on one of my servers Regards, Jan Want to buy your Pack or Services from

Re: [expert] The CodeRedWorm mystery

2001-08-16 Thread Gabriel Fortuna
Hey Guys And yea, on Thursday 16 August 2001 08:33, verily Jan Dittberner doth wroteth: [EMAIL PROTECTED] schrieb: How many have you had? According to my logs, as of right now, I've got 897. (This would be a fun competition! -- who's got the most default.ida hits?) Yeah, I suppose

Re: [expert] The CodeRedWorm mystery

2001-08-16 Thread Daniel Woods
[EMAIL PROTECTED] schrieb: How many have you had? According to my logs, as of right now, I've got 897. (This would be a fun competition! -- who's got the most default.ida hits?) As long as people are checking for unique hits. I added these lines to /root/.bashrc file (for CodeRed II

[expert] The CodeRedWorm mystery

2001-08-15 Thread Expert
I wonder when this worm is going to finally die? Keeps hitting my web server here. the NNN's are over and now its all X Want to buy your Pack or Services from MandrakeSoft? Go to http://.mandrakestore.com