[Xitami] "default.ida?"

[Craig Morrison]

Can you say, "Code Red"? I thought you could..

Seriously though, it is an infected system trying to infect your system via
Code Red.

1. No, not unless you want to spend all your time writing access masks.
2. They are trying to exploit a vulnerability that Xitami does not have.
3. They are trying to trigger a vulnerability in MS's IIS (v4,v5 unpatched)
that allows the virus to have SYSTEM access to your server. Since you are
running Xitami you don't have any worries.

Just to have a little fun I set up a page just for those unfortunate souls who
do get infected. Instead of returning a 404 error, Xitami on my system greets
them with a "nice" welcome. :-)

Eldridge Currie wrote:
> 
> Questions:
> 1. Is there anyway of keeping these people out of my system?
> 2. What are they looking for?
> 3. What does "default.ida?" mean?

-- 

Craig Morrison
  MTS Professional @ http://www.2cah.com/
  A Win32 Email server that works for _you_.
EzMTS - A _free_ Win32 EMail Server
  http://www.ezmts.org/
  Anonymous FTP at ftp://ftp.ezmts.org