[Xitami] Re: Xitami digest, Vol 1 #695 - 4 msgs
Utku Uzmen
xitami@lists.xitami.org
Mon, 9 Jun 2003 11:16:41 +0300
Dream in Peace,
Utku Uzmen
www.maddrive.com
----- Original Message -----
Date: Sun, 08 Jun 2003 12:35:00 -0700
To: Xitami List <xitami@lists.xitami.org>
From: Gunnar Swan <GunnarSwan@PracticeToPass.com>
Subject: [Xitami] HTTP corruption fixed ?
Reply-To: xitami@lists.xitami.org
We were getting corruptions on download of our setup.exe
The new box is in, formatted, new NT 4 Workstation sp6a, and locked down
Xitami is on it and running...
So far, we are not getting CRC errors
Would any (windoze) users be willing to download and attempt to install the
software and report if they get a CRC error ?
The URL to the download page is ...
http://www.contractorlicenseexam.com/Products/51725/51725-Download.html
Thanks.
Best Regards,
Gunnar Swan
Practice To Pass
1.888.307.2050
http://www.PracticeToPass.Com
--__--__--
Message: 2
From: "Patricko" <polson1@adelphia.net>
To: <xitami@lists.xitami.org>
Subject: Re: [Xitami] HTTP corruption fixed ?
Date: Sun, 8 Jun 2003 14:26:09 -0600
Reply-To: xitami@lists.xitami.org
Cool tool if I was into real estate :)
worked like a champ DLspeed 45K not bad you on DSL?
anyway I had no problems I am on cable 3Mbs could it be the 56K users that are
having this problem ?
----- Original Message -----
From: "Gunnar Swan" <GunnarSwan@PracticeToPass.com>
To: "Xitami List" <xitami@lists.xitami.org>
Sent: Sunday, June 08, 2003 1:35 PM
Subject: [Xitami] HTTP corruption fixed ?
>
> We were getting corruptions on download of our setup.exe
> The new box is in, formatted, new NT 4 Workstation sp6a, and locked down
> Xitami is on it and running...
> So far, we are not getting CRC errors
--__--__--
Message: 3
Date: Sun, 08 Jun 2003 14:06:52 -0700
To: xitami@lists.xitami.org
From: Gunnar Swan <GunnarSwan@PracticeToPass.com>
Subject: Re: [Xitami] HTTP corruption fixed ?
Reply-To: xitami@lists.xitami.org
>Cool tool if I was into real estate :)
Thanks. Written with Macromedia Director.
>worked like a champ DLspeed 45K not bad you on DSL?
>anyway I had no problems I am on cable 3Mbs
We're running 3/4 T1 up-down on cable modem.
We're out in the boonies and just so happen to have a fiber optic running up and
down the highway not far from our place.
>
could it be the 56K users that are
>having this problem ?
We think the hi-speed users were having the problem, but have not had negative
feedback.
Thanks for taking the time.
Best Regards,
Gunnar Swan
Practice To Pass
1.888.307.2050
http://www.PracticeToPass.Com
--__--__--
Message: 4
Date: Tue, 03 Jun 2003 16:07:59 +0200
From: Matthias Versen <matti@mversen.de>
To: xitami@lists.xitami.org
Subject: Re: [Xitami] what's this?
Reply-To: xitami@lists.xitami.org
Tom Baker wrote:
>> Questions about the logs On a few IP's that show up I get blocks of hits
>> that look like what is below.
>>
>> Any ideas as to what this is? A hacker or?????
>>
>> Thanks for any info!
>>
>> Jim Wooddell
>>
>> here is what I am seeing in my ac logs....
>>
>> 12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
>> /scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
>> 12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
> /MSADC/root.exe?/c+dir
>> HTTP/1.0" 404 -1 "" ""
>
> Code Red/ Code Red 2 worm is trying to exploit a hole in IIS. So the machine
> at 12.225.139.174 is infected, and is trying to infect you. Since you are
> not running IIS, this should not be a problem. Everybody gets these. If
> you're running Windows, make sure that everything is patched.
> The requests will show up as errors in your error log.
It's not Code Red....
Code Red Version 2 :
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9
090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u909
0%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a%20
HTTP/1.0" 404 -1 "" ""
(Version I use many "N")
Code Red V2 installs a backdoor (copy cmd.exe into the CGI-Directory of
the server and rename it to root.exe). You can run all commands on an
infected Server.
This here :
217.83.192.168 - - [25/May/2003:03:06:42 +0100] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 ""
is a "script Kiddie" trying to find an infected server.
>If you're running Windows, make sure that everything is patched.
a) You need only a Code Red patch if you use IIS (but Xitami is not
affected)
b) An unpatched Linux system is equal to an unpatched Windows system
Matthias
--__--__--
--
Xitami Users Mailing List -- Digest Version
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
End of Xitami Digest