Apache: default.ida ??

jharris · 08-09-2001, 12:21 PM

Anyone have any idea what might be looking for default.ida on my box? Or what default.ida is/does? I'm assuming its something that gets automatically requested like favicon.ico does by IE. Here are the log entries:

Code:

[Thu Aug  9 15:25:47 2001] [error] [client 62.22.41.120] File does not exist: var/lib/apache/htdocs/default.ida
[Thu Aug  9 15:53:54 2001] [error] [client 62.30.0.2] File does not exist: /var/lib/apache/htdocs/default.ida
[Thu Aug  9 16:07:36 2001] [error] [client 194.159.4.65] File does not exist: /var/lib/apache/htdocs/default.ida
[Thu Aug  9 16:19:32 2001] [error] [client 194.159.4.65] File does not exist: /var/lib/apache/htdocs/default.ida
[Thu Aug  9 16:54:16 2001] [error] [client 62.54.25.201] File does not exist: /var/lib/apache/htdocs/default.ida
[Thu Aug  9 17:05:14 2001] [error] [client 194.159.4.65] File does not exist: /var/lib/apache/htdocs/default.ida

cheers

Jamie...

trickykid · 08-09-2001, 01:34 PM

Looks like Code Red. Check out this link for info I pulled from google. http://www.dshield.org/codered.html or here http://searchwindowsmanageability.di...h%5E1@.ee84c8a but looks like it pertains to Windows.

jharris · 08-09-2001, 03:01 PM

Code Red? Nothing to worry about there then

cheers

Jamie...

trickykid · 08-09-2001, 03:08 PM

That is what I am talking about!!!!

Stupid Windows IIS machines. One of our Networks thru CSC ( Computer Sciences Corporation ) got infected on Monday cause some network admin forgot to update with a patch. That network still isn't working right, what a moron. Maybe they have an opening soon that I can apply for.

DavidPhillips · 08-09-2001, 06:50 PM

I see these too on cable modem, it is running rampant on my internet subnet.

LOL

mcleodnine · 08-10-2001, 02:47 AM

I'm getting hammered HARD on both my cable modem and DSL services. I'm just now looking into "Fighting a virus With a virus" on /. as I'm getting a little PO'd with the service probs.

Oh - and if you think the probes aren't that bad, have a look at the ARP requests on your subnet! they FLY through in tcpdump!

I found a neat script that lets you log connection attempts. You can see it at work at http://www.rivergems.com/codered_logs.html and the link to the perl script is at the top (the "GPL" link)

Browse and tell me how bad the transfer rates are - I need the input.

Thanks,
DMc