From owner-freebsd-questions Mon Aug 20 4:18:14 2001 Delivered-To: freebsd-questions@freebsd.org Received: from jason-n3xt.org (42.mujb.dlls.dllstxbk.dsl.att.net [12.98.249.42]) by hub.freebsd.org (Postfix) with ESMTP id 3BED437B405 for ; Mon, 20 Aug 2001 04:18:11 -0700 (PDT) (envelope-from jason@jason-n3xt.org) Received: from jason (44.mujb.dlls.dllstxbk.dsl.att.net [12.98.249.44]) by jason-n3xt.org (8.11.4/8.11.5) with SMTP id f7KBI6B21427 for ; Mon, 20 Aug 2001 11:18:06 GMT (envelope-from jason@jason-n3xt.org) From: "Jason Halbert" To: Subject: Code Red Date: Mon, 20 Aug 2001 11:18:09 -0000 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 Importance: Normal Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hello Everyone: I just want to clear something up. Something that's bothering me that is.. The Code Red Worm is strictly an NT IIS thing, right? The console of my web server is used for watching the access log file of my Apache web server. I am seeing quite a few of those requests for "default.ida" followed by the "X"s and then the code. I'm sure you are familiar with it. According to the log as it scrolls along on the screen, Apache just sends a 404. I have been told also that even Apache servers running under Windows would be unaffected. I know that it is not as easy to write a virus for UNIX because of the fundamentals of how UNIX works, but I would just like some clarification. Also, another note of interest.. These Code Red requests seem to be coming from other boxes in my domain (*.dsl.att.net) and no where else. Anyone like to venture a guess as to why? TIA ---- Jason Halbert jason@jason-n3xt.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message