[Xitami] CodeRed.worm and McAfee

[Ewen McNeill]

In message <5.1.0.14.0.20010822154007.00a6b0c0@mail.yahoo.com>, DanLM writes:
>I received an alert from my McAfee antivirus, I know that using xitami web 
>server the virus can't input on my Windows95 system. The message was: (in 
>french)
>
>Fichier infecté:
>C:\Xitami\DEBUG\request.log
>Nom du virus:
>W32/CodeRed.worm

Log files are just that -- logs.  They might happen to contain a copy of
the virus (because it's sent as one big URL request), but in the log
file it's basically inert.  There's no way it can run, or spread or
anything.

It sounds like McAfee antivirus is just looking for patterns which
happen to match viruses, without any real consideration for why they
might be there, or what that might mean.  Hence the false alarms.

You might want to consider whether you want Xitami in debug mode (that's
how request.log is generated), as it can generate bit log files, but
otherwise you don't have a problem).  CodeRed (and its variations) can
only affect Microsoft IIS servers that haven't been patched against it.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com