[Xitami] CodeRed.worm and McAfee

[Paul Reid]

> Fichier infecté:
 C:\Xitami\DEBUG\request.log
 Nom du virus:
 W32/CodeRed.worm

> Any explanation ? There is a potential risk ?

The only odd thing is: you should have been getting these warnings all
month. Everybody with any software that uses port 80 (the usual HTTP
protocol port) has been getting hits from CodeRed machines. 

If this is the first time you've run your virus scanner since July, then
that's OK. 

> GET /default.ida?XXXXXX............

Yes, that IS the virus. (And thanks for cutting off the extra 3000 bytes
in this email.) Send that request to an un-patched MS IIS server, and it
will be infected. Except that odds are that ALL the IIS servers in the
world are already infected. 

Having that virus sitting in your log files is quite safe. 

In fact it is a little silly for your virus checker to warn you. CodeRed
does not live in files, because it can only infect via an HTTP request
to a IIS server. A copy of CodeRed in a log file means that you are
studying the virus, or it tried to infect you and failed, and your
server simply noted the "bad request". 

 -PRR