[Xitami] "default.ida?"

[Jason]

I've had over 300 hits on my server - all code red related. This site
isn't even a very well known or popular site.  It is frustrating to see
the logs of errors.  90% of them are cable subscribers .. I just hope it
ends soon.

Jay

Can you say, "Code Red"? I thought you could..

Seriously though, it is an infected system trying to infect your system
via Code Red.

1. No, not unless you want to spend all your time writing access masks.
2. They are trying to exploit a vulnerability that Xitami does not have.
3. They are trying to trigger a vulnerability in MS's IIS (v4,v5
unpatched) that allows the virus to have SYSTEM access to your server.
Since you are running Xitami you don't have any worries.

Just to have a little fun I set up a page just for those unfortunate
souls who do get infected. Instead of returning a 404 error, Xitami on
my system greets them with a "nice" welcome. :-)

Eldridge Currie wrote:
> 
> Questions:
> 1. Is there anyway of keeping these people out of my system? 2. What 
> are they looking for? 3. What does "default.ida?" mean?

-- 

Craig Morrison
  MTS Professional @ http://www.2cah.com/
  A Win32 Email server that works for _you_.
EzMTS - A _free_ Win32 EMail Server
  http://www.ezmts.org/
  Anonymous FTP at ftp://ftp.ezmts.org

--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami