[Xitami] A Hack Attempt or What?

[Thomas J. Hruska]

At 10:42 AM 8/6/01 +1200, you wrote:
>In message <20010805183840.17246.cpmta@c012.sfo.cp.net>, GunnarSwan writes:
>>[CodeRed requests]
>>Again, I am running Xitami on NT set up as a bastion host.  
>>Is it safe to assume that all the IP addresses in my Access and Error
logs ... 
>>that all those machines have been infected?
>
>Yup.  It's the infecting machines which try to access yours with that
>CodeRed (default.ida?[NX]*....) pattern, in order to infect yours (if it
>was IIS -- they just try to infect, they don't check what it is first).

Actually, I have had a couple CodeRed _initiators_ on my system.  That is,
people purposely attempting to infect machines with CodeRed.  I'm still
waiting for replies to a couple e-mails to find out what I should do with
those IP addresses in particular.


           Thomas J. Hruska -- shinelight@crosswinds.net
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/