Re: code red goes on
At 12:27 AM 8/3/01 -0700, Mike Egglestone wrote:
>Hi..
>
>I grepped my access logs and noticed the "default.ida?NNNN etc etc..
>
>What does this mean?
>Have I been attacked? or was it an attemped attack?
>
>What exactly does the virus do to the system?
>
>Thanks
>Mike
>
If your run unpatched MS webservers u've been attacked if not you're just watching an attack rush past on it's way somewhere else.
on the 20th of the months the infected machines are all going to launch a denial of service attack at a web-server somewhere (last time was the IP address of the whitehouse but that mor, or may not, have changed)
not much you can do
but if u track the hits you can tell for yourself where the worm is at.
http://www.theregister.co.uk/content/56/20749.html
for good coverage
Reply to: