From owner-freebsd-stable Tue Sep 18 21:41:43 2001 Delivered-To: freebsd-stable@freebsd.org Received: from rshb.com.ru (rshb.com.ru [195.162.58.1]) by hub.freebsd.org (Postfix) with ESMTP id 3D05637B41E for ; Tue, 18 Sep 2001 21:41:40 -0700 (PDT) Received: from rshb.com.ru (vampiro.rsb.local [192.168.1.111]) by rshb.com.ru (8.11.6/8.11.6) with ESMTP id f8J4fdw69650 for ; Wed, 19 Sep 2001 11:41:39 +0700 (OMSST) (envelope-from admin@rshb.com.ru) Message-ID: <3BA8221D.4090805@rshb.com.ru> Date: Wed, 19 Sep 2001 11:42:05 +0700 From: "Evgueni V. Gavrilov" User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.4) Gecko/20010918 X-Accept-Language: ru, en MIME-Version: 1.0 To: freebsd-stable@FreeBSD.org Subject: Re: virus ? References: <20010919043819.45703.qmail@web20108.mail.yahoo.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG klein brock wrote: >i'm currently using freebsd4.4-prerelease .... but my >server is infected by a virus: > >208.187.190.248 - - [18/Sep/2001:20:40:04 -0700] "GET >/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir >HTTP/1.0" 404 301 > >if i upgrade it to 4.4-stable, will the virus remove >from my server ? or i have to re-install by cd and >cvsup ? > you ain't infected. that was requests from infected win32 servers. >can i know what the possibility that my server >infected by this virus ? > approx. 0.000000000000000000000000000000000001 (i could suppose that you would run IIS under vmware) -- VAMPIRO-RIPN To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message