Re[2]: [Xitami] what's this?

[Thomas J. Hruska]

At 10:55 AM 6/3/2003 -0400, Paul Reid writeth:
>> keep looking down the log!
>
>dammit, my eyes are too weak to read your logs, especially in
>double-wrap-quote shape, and with not enough coffee in me yet.
>
>I suppose you see some "200" responses. The requested URL is
>illegal. On IIS, that tricks IIS into doing something it should not
>do. But Xitami knows it is illegal and truncates the URL at the
>illegal encoding, figuring it must be a mis-typing. The remaining
>URL points to your Home Page, which Xitami sends back and logs as
>happiness. That isn't the response the worm was hoping for, too bad.

That's no worm...those are script kiddies attempting to upload and hook
patched DLLs into compromised IIS servers...most likely for zombie attacks
as well as more refined control of the systems.  There are real people
behind those.  I've also seen various systems trying to deliberately
propagate CodeRed/CodeRed II (mostly Linux boxes...).

Hope this helps!


          Thomas J. Hruska -- shinelight@shininglightpro.com
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/