From owner-freebsd-questions Mon Nov 5 14:49:41 2001 Delivered-To: freebsd-questions@freebsd.org Received: from blacklamb.mykitchentable.net (ekgr-dsl5-t183.citlink.net [207.173.250.183]) by hub.freebsd.org (Postfix) with ESMTP id 71C6B37B405 for ; Mon, 5 Nov 2001 14:49:39 -0800 (PST) Received: from bigdaddy (bigdaddy [192.168.1.3]) by blacklamb.mykitchentable.net (Postfix) with SMTP id 61956EE547 for ; Mon, 5 Nov 2001 14:50:03 -0800 (PST) Message-ID: <011001c1664c$2111b200$0301a8c0@bigdaddy> From: "Drew Tomlinson" To: Subject: Apache mod_rewrite Help Date: Mon, 5 Nov 2001 14:49:30 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I'm using Apache 1.3.19 on FBSD 4.4 and am trying to redirect any GET requests that are a result of a IIS worm to an existing file on my server. I'm under the impression that the follow directives should accomplish this: RewriteEngine on RewriteLog "/var/log/httpd-rewrite.log" RewriteLogLevel 2 RewriteRule .*cmd.exe* /IIS_viri.ida RewriteRule .*root.exe* /IIS_viri.ida RewriteRule .*Admin.dll* /IIS_viri.ida where any URL contains either "cmd.exe", "root.exe", or "Admin.dll" anywhere in the string, it will be redirected to IIS_viri.ida in my ServerRoot. Shouldn't this work? To test this, I go to the URL http://www.mykitchentable.net/cmd.exe but nothing gets redirected and the following error appears in my log: 192.168.1.3 - - [05/Nov/2001:14:38:54 -0800] "GET /cmd.exe HTTP/1.1" 404 338 So what am I doing wrong? I am new so please don't assume I've done all the obvious things (although I did restart Apache :) ). Any help would be appreciated. Thanks, Drew To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message