[Xitami] Where do requests for GET /default.ida come from in access.log

[Ewen McNeill]

In message <e0.194ea16f.28b32b3d@aol.com>, Iwski13@aol.com writes:
>128.211.240.66 - - [20/Aug/2001:18:52:40 -0500] "GET /default.ida?XXXXXXXXXXXXX
>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u
>9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8
>b00%u531b%u53ff%u0078%u0000%u00=a%20 HTTP/1.0" 200 0 "" ""
>
>Does anybody know what that means?  

It's a CodeRed attempt.  The mainstream media have been talking about
this for about three weeks, and the worm has been around in various
forms for about a month or so.

>I get about 10 an hour and from different IP addresses, but most (not all) 
>start with 128.x.x.x  

CodeRedII (the varient in that log message) tries to infect machines
"close to home", ie in the same range of IP addresses as it is in.  So
you'll get a lot of them from the address block you are in.

Xitami isn't vulnerable to this worm (only IIS without patches can be
infected, but some other webservers crash), so it's merely an annoying
way to fill up your log files.

When all the IIS webserver administrators finally patch their machines,
clean them up, and reboot them, the problem will go away.  Given that
there's been three weeks of media publicity and there's still plenty of
infected machines around I wouldn't hold your breath.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com