[Xitami] RE: Bigtime Newbie

[Jill Heske]

Claude,

I have two separate issue here.  The first is a static IP address that has
been hitting my site for quite some time.  Since it is static I can, and
have, masked it out.

The other issue is the strange /default.ida requests.  I have since gathered
from this listserver that these are *harmless* Code Red probes, sent by the
infected machines whose addresses are in my log files.  From what I
understand these probes just dead end, unable to penetrate and propagate
because I don't have IIS.  After zillions of these probes I do not find
root.exe anywhere on any of my systems.  Is there some reason to believe
that Code Red can infiltrate my system even thru Xitami?

Jill

> -----Original Message-----
> From: Claude jr Seagen [mailto:seagen_jr@chello.no]
> Sent: Saturday, August 11, 2001 6:02 PM
> To: jheske
> Subject: Re: Bigtime Newbie
>
>
> You are infected by the Code Red Virus.
> Install SP2 and download the Patch for code red
>
> All those ip addresses you find in your log file are other
> computer that are
> infected.
>
> Search for ROOT.EXE if you find this file you are 100% infected.
>
> For more info go to Microsoft.com and search for "Code Red"
>
> The Swede
>
>
>
> ----- Original Message -----
> From: "jheske" <jheske@mindspring.com>
> Newsgroups: comp.security.firewalls
> Sent: Thursday, August 02, 2001 8:20 PM
> Subject: Re: Bigtime Newbie
>
>
> > Many thanks  for the replies and the info.   This activity has
> been going
> on
> > since before CodeRed was an issue, although I do run NT (not IIS) so
> perhaps
> > there is a relationship.  I have done traceroute but I'm not sure what
> that
> > tells me.  It just ends up at RR's nebulous proxy server.   I'll try to
> > contact RR's security dept.  I know there is no way to talk to a live
> person
> > there, since I have tried to no avail.  I can configure my
> firewall since
> > this is a static address that shows up over and over.  However, I would
> > really like to know what this is.   Is there some runtime utility I can
> use
> > to "capture" this in action and get more info?
> >
> > By the way, I am also getting lots of probes like the one
> below.  Each one
> > has a *completely* different address, and most of them can't be resolved
> at
> > all.  Any idea what this means?  I don't have any idea how to
> block these
> > with my firewall.    Thanks very much again for your expertise.
> >
> > JHeske
> >
> > 210.164.219.3 - - [02/Aug/2001:02:07:33 -0500] "GET
> >
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNN
> >
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNN
> >
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNN
> >
> NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6
> 858%ucbd3%
> >
> u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a%20
> > HTTP/1.0" 404 0
> >
> >
> >
> >
> >
>