From owner-freebsd-stable  Tue Sep 18 21:49: 7 2001
Delivered-To: freebsd-stable@freebsd.org
Received: from sanctuary.magill.unisa.edu.au (sanctuary.magill.unisa.edu.au [130.220.227.239])
	by hub.freebsd.org (Postfix) with ESMTP id 0F86A37B41A
	for <freebsd-stable@FreeBSD.org>; Tue, 18 Sep 2001 21:49:03 -0700 (PDT)
Received: from localhost (sayersjm@localhost)
	by sanctuary.magill.unisa.edu.au (8.11.6/8.11.4) with ESMTP id f8J4n6O80051;
	Wed, 19 Sep 2001 14:19:06 +0930 (CST)
	(envelope-from Jarrod.Sayers@unisa.edu.au)
Date: Wed, 19 Sep 2001 14:19:05 +0930 (CST)
From: Jarrod Sayers <Jarrod.Sayers@unisa.edu.au>
X-X-Sender:  <sayersjm@sanctuary.magill.unisa.edu.au>
To: klein brock <getzz1@yahoo.com>
Cc: <freebsd-stable@FreeBSD.org>
Subject: Re: virus ?
In-Reply-To: <20010919043819.45703.qmail@web20108.mail.yahoo.com>
Message-ID: <20010919141634.O54987-100000@sanctuary.magill.unisa.edu.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

On Tue, 18 Sep 2001, klein brock wrote:

> Date: Tue, 18 Sep 2001 21:38:19 -0700 (PDT)
> From: klein brock <getzz1@yahoo.com>
> To: freebsd-stable@FreeBSD.org
> Subject: virus ?
>
> i'm currently using freebsd4.4-prerelease .... but my
> server is infected by a virus:
>
> 208.187.190.248 - - [18/Sep/2001:20:40:04 -0700] "GET
> /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
> HTTP/1.0" 404 301
> 208.187.190.248 - - [18/Sep/2001:20:40:04 -0700] "GET
> /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir
> HTTP/1.0" 404 301
>
> if i upgrade it to 4.4-stable, will the virus remove
> from my server ? or i have to re-install by cd and
> cvsup ?

There is no virus on your machine, its a Windows machine somewhere trying
to infect your server.  Unless your running IIS on it somehow, then you
don;t have anything to worry about.

http://www.mcafee.com/anti-virus/viruses/nimda/default.asp?cid=2444

> can i know what the possibility that my server
> infected by this virus ?

0%?

Jarrod Sayers
Information Technologist
School of Communication, Information and New Media
University of South Australia, Magill Campus.
Phone: +61 8 83024045
Fax: +61 8 83024745


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message