Hi,

I've noticed that recently I am getting quite a few of these messages in
/var/log/httpd/access_log:

64-171-245-20.ded.pacbell.net - [10/Aug/2001:16:53:22 -0700] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 299

All from different IP adresses. Anyone know what this means? I know 404 is "The requested URL was not found on this server." I guess my question is what is /default.ida?XXX… Is this a bad page somewhere in my web dir?

TIA for any help

Your bandwidth is jammed
Your logs full of goo

That would be CodeRedII

Thx. any suggestions other than shutting down https?

thx

yep...welcome to the Code Red Club...there is nothing you can do...other than wait it out

I will be glad when that damn code red is contained, but of course, as always some brillant soul will modify it and send it out again!!

well i think the only way it will EVER end is if someone modifies the code in it, or creates a new virus to destroy Code Red...there are 2 known verisons of CR now, and a third is thought to have been created.

If you run php by chance, and want to have a little fun with codered, there's a script that will display the number of times you've been probed by it.

http://vsadesign.com/download.php

I just threw a hack script together real quick to get an idea of who is jamming me via CD2. crude, but effective:

target=`date|awk '{print $3"/"$2}'`
date=`date|cut -c5-11,25-|sed 's/\([0-9]\{1,2\}\)/\1,/'`
time=`date|awk '{print $4}'`

cat /var/log/httpd/access_log|grep default|awk '{print $1,$4}' >/tmp/codered
echo -n "Code Red II has hit your site on $date $time"|mail root
cat /tmp/codered|sort -u|grep $target|mail root
total=`cat /tmp/codered|sort -u|grep $target|wc -l`

echo "There have been $total CODE RED 2 hits as of $time"|mail root