[Xitami] Where do requests for GET /default.ida come from in access.log

[Brian {Hamilton Kelly}]

In message <200108210323.PAA19968@pagoda.in.naos.co.nz>
   Ewen McNeill writes:
> In message <e0.194ea16f.28b32b3d@aol.com>, Iwski13@aol.com writes:
[snip ubiquitous CR2 request]
> >Does anybody know what that means?  
> 
> It's a CodeRed attempt.  The mainstream media have been talking about
> this for about three weeks, and the worm has been around in various
> forms for about a month or so.
[snip rest of explanation]
> When all the IIS webserver administrators finally patch their machines,
> clean them up, and reboot them, the problem will go away.  Given that
> there's been three weeks of media publicity and there's still plenty of
> infected machines around I wouldn't hold your breath.

On which point, I find it perfectly reprehensible that someone could be
knowingly running a webserver and yet be unaware of the existence of Code
Red.  After all, the majority of infected instances of IIS exist because
their owners were blissfully unaware that the webserver had been
installed by default.

ANYONE running ANY sort of semi-permanently connected server should
ensure that they are up-to-date with CERT advisories for their platform;
it's a duty that they have to the integrity of the rest of the 'Net.

Incidentally, there should be a respite for a few days now: all the
machines infected with Code Red (1 or 2) are now (from the 20th of each
month) instead launching a DoS attack on the IP address that used to be
one of the servers forming www.whitehouse.gov.  This will continue until,
IIRC, the 28th, when the worm will go dormant; only to start another
month's attempt of infestation on the 1st.

-- 
Brian {Hamilton Kelly}                                          bhk@dsl.co.uk
    "We have gone from a world of concentrated knowledge and wisdom to one of
    distributed ignorance.  And we know and understand less while being incr-
    easingly capable."              Prof. Peter Cochrane, formerly of BT Labs