Re[2]: [Xitami] LOG Filter to remove those log-entries created byhttp-viruses.

[Spyman]

These are seperate from the ones that are indicated by Nidma from the
previous email.

These logs are from something different. (At least I think so)

There is nothing in the website logs at the present time.

But the others keep pouring in. I have a 2.5 mb log right now for today's
entries.

-----Original Message-----
From: xitami-admin@lists.xitami.org
[mailto:xitami-admin@lists.xitami.org]On Behalf Of Paul Reid
Sent: Tuesday, February 19, 2002 6:10 PM
To: Spyman
Subject: Re[2]: [Xitami] LOG Filter to remove those log-entries created
byhttp-viruses.


> Any ideas what they are trying to do? I have noticed them on and
>off for several weeks now.

CodeRed and Nimda have been flogging the internet for months.

The very-very long request causes an overflow in some web servers.
The intended target is unpatched MS IIS. On that server, the
overflow writes on program space. The little bit of goblygook at the
end is CPU code that "is" the virus.

They also make some other servers unhappy, but because they don't
have the same program code in the same spot they don't get infected.
Just maybe crash.

Xitami is quite immune to the CodeRed exploit. Its writers assumed
that requests might have garbage in them and don't let requests
overflow into program space.

>All trying to hit port 8888

Very odd, it is usually port 80. Maybe a new variant hoping to hit
all you guys behind ISPs that block 80.

 -PRR


--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami