On Thu, 20 Sep 2001, Edward Salm wrote:
> That darn Code Red Worm keeps hitting my server, at least 10-50 times a day.
> It does no damage to a Mac; however, things frequently grind to a halt until
> it times out. And if any java is running, forget it!
>
> My email and web server are on the same machine (G3 B&W 350).
>
> Anybody know a way to block this thing?
>
> The call to the web server is:
> "GET /default.ida?"
>
You have SIMS listening on port 80 or something? Change SIMS to listen on
8080 or some other port. If you mean this is bugging your webserver then
this is not really the list to use. There is very little you can do about
it. You can make a list of infected server (from your logs) and block them
at the border router. You can try to find a list from someplace else you
trust. You can ignore it. I shortened by 404 and 400 responses to less
than 10 bytes to save bandwidth (not that it is eating a lot of our fat
pipe, but to save bandwith on the net as a whole, every little bit
counts.. though this will proabably add up to like 1Mb over a month ;-)
Joe Laffey |
LAFFEY Computer Imaging |
St. Louis, MO +--------+ +-------+
---------------------- |++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
|++++++++| |+++++++|
+--------------------------------------+
| AMERICA STANDS TOGETHER |
+--------------------------------------+
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
