OK, I know this is not exactly on-topic, but I thought it was ridiculous enough to share. Here's what I get from the logs on my IRIX web server running apache: 7273 809 811 so, that's 8,893 bogus MS exploit requests. note too, that those numbers grew by about 5% in about 5 minutes. Damn, I'm glad I don't run a windows machine :) - Dan Wright (dtwright(a)uiuc.edu) (http://www.uiuc.edu/~dtwright) -] ------------------------------ [-] -------------------------------- [- ``Weave a circle round him thrice, / And close your eyes with holy dread, For he on honeydew hath fed, / and drunk the milk of Paradise.'' Samuel Taylor Coleridge, Kubla Khan

It started coming in at my linux webserver at 15:55 local time (the Netherlands) that is 14:55 UTC Fortunately it doesn't do anything usefull exept that it cloggs up my access_log If this is the way of the future... MS*cks driven webservers are doomed! Besides this newbie I had about 1500 Code Red tries in August, and about 800+ uptil now in September. Code-Red was just leveling off a bit. below a snip from my access_log: (sorry for the wrapping) 4.18.92.2 - - [18/Sep/2001:19:24:50 +0200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 280 4.18.92.2 - - [18/Sep/2001:19:24:51 +0200] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 278 4.18.92.2 - - [18/Sep/2001:19:24:52 +0200] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 288 4.18.92.2 - - [18/Sep/2001:19:24:52 +0200] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 288 4.18.92.2 - - [18/Sep/2001:19:24:53 +0200] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 302 4.18.92.2 - - [18/Sep/2001:19:24:57 +0200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 319 4.18.92.2 - - [18/Sep/2001:19:25:01 +0200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 319 4.18.92.2 - - [18/Sep/2001:19:25:05 +0200] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system 32/cmd.exe?/c+dir HTTP/1.0" 404 335 Regards, Sipke de Wal ---------------------------------------------------------------- http://xgistor.ath.cx ---------------------------------------------------------------- ----- Original Message ----- From: Marion Bates <Marion.Bates(a)dartmouth.edu> To: <classiccmp(a)classiccmp.org> Sent: Tuesday, September 18, 2001 7:11 PM Subject: Worm/Virus alert you folks might want to know to watch out for a new Code Red-esque worm that's running rampant...below is from SlashDot. http://slashdot.org/articles/01/09/18/151203.shtml boxes with many different exploits (including what looks like an attempt to exploit boxes still rooted by Code Red). It looks like each IP tries 16 attempts on its neighbors. There is also a new mail worm mailing WAV files or something with bits of what appears to be the registry... it may or may not be related. Got any words on this? Shut down those windows boxes and stop opening attachments. And make that 21. Got another one while writing this story. All my hits are coming from 208.n.n.n (where I am) I'm sure it'll keep moving to nearby boxes. ..%c1%1c../winnt/system32/cmd.exe?/c+dir attack. In only 4 minutes. Also of interest, My desktop has now been hit about 500 times today, all from 208.x.x.x IPs. This might be really bad. I still haven't read anything about this anywhere else, so you heard it here first ;) to all web pages served... and due to a bug in IE5, it will automatically execute the file! Yay Internet Explorer!