It's on Apache servers...does the worm execute on UNIX servers? Here is an example of the log:
"0" "8Jan2003" "14:52:28" "VPN-1 & FireWall-1" "eth2" "scary" "log" "reject" "3257" "web1" "YahooBB219026146030.bbtec.net" "21" "http" "" "1" "8Jan2003" "14:52:28" "VPN-1 & FireWall-1" "eth2" "scary" "log" "reject" "62478" "web2" "ntkngw046029.kngw.nt.adsl.ppp.infoweb.ne.jp" "21" "http" "" "2" "8Jan2003" "14:52:29" "VPN-1 & FireWall-1" "eth2" "scary" "log" "reject" "62479" "web2" "ntkngw046029.kngw.nt.adsl.ppp.infoweb.ne.jp" "21" "http" "" "3 -Devon -----Original Message----- From: Hal Dorsman [mailto:[EMAIL PROTECTED]] Sent: Wednesday, January 08, 2003 12:04 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] Outgoing http request? Could be Code Red. Could be automatic updates. You don't say to where the request is going. If it's lots and lots going to everywhere, it's a worm. Hal Hal Dorsman Network Administrator Rocky Mountain Elk Foundation Missoula, Montana USA [EMAIL PROTECTED] (406)523-4576 > -----Original Message----- > From: Devon Harding - GTHLA [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, January 08, 2003 9:28 AM > To: [EMAIL PROTECTED] > Subject: [FW-1] Outgoing http request? > > > I noticed in my log, I have out going http request from my > DMZ web servers > that are being rejected (by my 'any - any -any reject' rule) > > No one is on this machine, how are these requests being > initiated? Is this a > hack attempt? > > _____________________ > Devon Harding > System Administrator > Gilat Latin America > 954-858-1600 > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > > ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
