From owner-freebsd-questions  Thu Nov 15 18:57:24 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from mtiwmhc26.worldnet.att.net (mtiwmhc26.worldnet.att.net [204.127.131.51])
	by hub.freebsd.org (Postfix) with ESMTP id 9F1B337B419
	for <freebsd-questions@freebsd.org>; Thu, 15 Nov 2001 18:57:20 -0800 (PST)
Received: from columbia ([12.93.212.237]) by mtiwmhc26.worldnet.att.net
          (InterMail vM.4.01.03.27 201-229-121-127-20010626) with SMTP
          id <20011116025719.ELMO4964.mtiwmhc26.worldnet.att.net@columbia>;
          Fri, 16 Nov 2001 02:57:19 +0000
From: "Andrew C. Hornback" <achornback@worldnet.att.net>
To: "Keith Spencer" <bsd2000au@yahoo.com.au>,
	"fbsd" <freebsd-questions@freebsd.org>
Subject: RE: Is this an attack guys???Help!
Date: Thu, 15 Nov 2001 21:56:38 -0500
Message-ID: <009c01c16e4a$4f65ee40$6600000a@ach.domain>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0
X-MIMEOLE: Produced By Microsoft MimeOLE V5.00.2919.6600
In-Reply-To: <20011116024710.22642.qmail@web12005.mail.yahoo.com>
Importance: Normal
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

> -----Original Message-----
> From: owner-freebsd-questions@FreeBSD.ORG
> [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Keith Spencer
> Sent: Thursday, November 15, 2001 9:47 PM
> To: fbsd
> Subject: Is this an attack guys???Help!
>
> Hi all,
> This is an Apache error log snippet.
> My server is infact FreeBSD 4.4
> I often find these page request errors from the same
> address or one of the same C-class space.
> IT looks lke an attack to me...What thinks you?
> Thanks Keith
> +++++++++++++++++++++++++++++++++++

[log snipped]

	You're being attacked by the Nimda/Code Red series of virii.  Biggest
things you've got to worry about are filling up your log files with this
crap and filling up your pipe to the rest of the world.  As far as I know,
you're in no danger of actually being compromised by this.

--- Andy


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message