D&C Lug - Home Page
Devon & Cornwall Linux Users' Group

[ Date Index ][ Thread Index ]
[ <= Previous by date / thread ] [ Next by date / thread => ]

RE: [LUG] Virus



Speaking of viruses, Nimda/code red etc are really beginning to get on my
nerves.
These damn people who run IIS and don't patch it are driving my web logs
crazy. My var partition isn't massive and it's come close to
filling up on a
few occaisions - obviously this would have cripple my server.

Yeah I agree, even after the publicity of Code red virus.  On my Linux box,
I have a little script that counts code red scansn in the apache logs.  Now
my logs rotated this morning, and I've only been online for the last 30
minutes, and already there have been 8 scans.

question:
As these viruses are requesting something from my web server, if my sever
served say a file called nimba.ida would I be right in saying that this
would be perfectly legal.

Think the file is default.ida

I have a script (untested at present) which would cause a popup window on
IIS servers saying that they had a virus.
I know that code red leaves a huge backdoor on systems that it's infected
and I'm starting to get to the point where I'll take advantage of it and
start leaving some nasty messages for incompetent administrators.

Hmm, I dont think they would take any notice, if they have not patched their
box after all this time.   I'm not sure, but I've thought there was a script
going around that patched the server!  Was there a simular a while ago that
patched a security hole in bind dns servers?

Pete Hatton
---------------------------------
E-mail:  pete@xxxxxxxxxxxxx
Webpage: http://www.monolight.org
---------------------------------


--
The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe.


Lynx friendly