Re[2]: [Xitami] LOG Filter to remove those log-entries created byhttp-viruses.

[Paul Reid]

> Any ideas what they are trying to do? I have noticed them on and
>off for several weeks now.

CodeRed and Nimda have been flogging the internet for months.

The very-very long request causes an overflow in some web servers.
The intended target is unpatched MS IIS. On that server, the
overflow writes on program space. The little bit of goblygook at the
end is CPU code that "is" the virus.

They also make some other servers unhappy, but because they don't
have the same program code in the same spot they don't get infected.
Just maybe crash.

Xitami is quite immune to the CodeRed exploit. Its writers assumed
that requests might have garbage in them and don't let requests
overflow into program space.

>All trying to hit port 8888

Very odd, it is usually port 80. Maybe a new variant hoping to hit
all you guys behind ISPs that block 80.

 -PRR