[Xitami] Where do requests for GET /default.ida come from in access.log

[Thomas J. Hruska]

At 11:10 PM 8/20/01 EDT, Iwski13@aol.com writeth:
>I am running the xitami server and only have one problem, or maybe it's
not a problem but if somebody could explain it that'd be great.  In the
access log there are MANY instances of the following line:
>
>128.211.240.66 - - [20/Aug/2001:18:52:40 -0500] "GET
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a%20
HTTP/1.0" 200 0 "" ""
>
>Does anybody know what that means?  I get about 10 an hour and from
different IP addresses, but most (not all) start with 128.x.x.x  Is this a
problem?  If not, is there a way I can not log it?  Log files build very
quickly like this.
>
>Thanks for any help anybody can give me.

Yup - everyone has logs like that.  It is CodeRed II attempting to infect
your web server (however, your system can't be infected if you are running
Xitami on port 80 - it only works on IIS).  I guesstimate at least half a
million infected machines are still out there (mostly Windows 2000 users
who haven't run the patch and don't know that they are running a web server
- probably more like 1-2 million are infected, but there have to be quite a
few still left to be hitting servers at the current rate).

BTW, why is your Xitami server responding with 'HTTP/1.0 200 OK'?


           Thomas J. Hruska -- shinelight@crosswinds.net
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/