I do believe that is the nimda freak, code red would entail default.ida?NNNNNNNN ( or XXXXX, 0000000)
linux.nf is no more. All things are the same with the domain change of linux-sxs.org HTH, On Wednesday 20 February 2002 03:10, you were heard blurting out: > On Tue, 19 Feb 2002 22:04:48 -0800 > > Ken Moffat <[EMAIL PROTECTED]> wrote: > > (Let's see if this is the correct address for the list? Got a bounce > > from linux.nf) > > > > Here is part of my apache error_log, > > which makes me think someone is trying to gain access. > > Could this be some cracker? > > There are a whole bunch of these in the log. > > > > Anyone know .... ? > > > > > > [Tue Feb 19 05:34:48 2002] [error] [client 216.162.75.7] File does not > > exist: /var/www/html/scripts/root.exe[Tue Feb 19 05:34:48 2002] > > > > [error] [client 216.162.75.7] File does not exist: > > /var/www/html/MSADC/root.exe > > > > [Tue Feb 19 05:34:49 2002] [error] [client > > 216.162.75.7] File does not exist: > > /var/www/html/c/winnt/system32/cmd.exe > > > > [Tue Feb 19 05:34:49 2002] > > [error] [client 216.162.75.7] File does not exist: > > /var/www/html/d/winnt/system32/cmd.exe > > > > > > I wonder who is 216.162.75.7? > > someone with an infected Windows IIS box, IIRC this is the "code red" > worm. -- Bill Day Our crystal tears now fall upon the ashes, but from the dust shall grow a spirit, to be in compassion for those who are lost, and one in determination to break those who dare test our resolve to be free... 9/11/01 http://www.daysdomain.com/tribute.html 5:30am up 202 days, 20:36, 12 users, load average: 0.00, 0.02, 0.11 _______________________________________________ Linux-users mailing list - http://linux-sxs.org/mailman/listinfo/linux-users Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.
