Been there, done that. Already patched the server two days back, still getting the same thing at 4:02 AM
--- Russell Morrison <[EMAIL PROTECTED]> wrote: > I do believe this is the Chunk encoding exploit that > showed up last week > on apache. Check http.apache.org for more > information or go to the > securityfocus website for information. A number of > patches or fixes > have already been released by various vendors. > > HTH. > > -----Original Message----- > From: khan rohail [mailto:[EMAIL PROTECTED]] > Sent: June 25, 2002 9:42 AM > To: [EMAIL PROTECTED] > Subject: Apache Problem, Hack, Worm, or Something > else > > > I am new to this, I searched for the following > errors > but wasnt pointed to something specific. I want to > know whether my machine was hacked or there is > something. > I did check my cron jobs and there is nothing which > is > should start the httpd server. > > If I am not mistaken the ador worm does the same > thing > at 4:02 am but I checked that too throug ./adorefind > but negative. > > Need some help here from gurus! > > > Tue Jun 25 04:02:04 2002] [warn] child process 6383 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 6384 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 6385 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 6386 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 6395 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 6396 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 6397 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 6398 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 7946 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 7981 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 7994 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 7995 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 7998 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 7999 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 8000 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 8001 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:04 2002] [warn] child process 8432 > did not exit, sending another SIGHUP > [Tue Jun 25 04:02:06 2002] [notice] SIGHUP received. > > Attempting to restart > [Tue Jun 25 04:02:08 2002] [notice] Apache/1.3.22 > (Unix) (Red-Hat/Linux) mod_ssl/2.8.5 OpenSSL/0.9.6b > mod_perl/1.26 > configured -- resuming normal operations [Tue Jun 25 > 04:02:08 2002] > [notice] suEXEC mechanism enabled (wrapper: > /usr/sbin/suexec) [Tue Jun > 25 04:02:08 2002] [notice] Accept mutex: > sysvsem (Default: sysvsem) > > __________________________________________________ > Do You Yahoo!? > Yahoo! - Official partner of 2002 FIFA World Cup > http://fifaworldcup.yahoo.com > __________________________________________________ Do You Yahoo!? Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com
