httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Alex \"Sniper\" Togstad" <sni...@3dretreat.com>
Subject Re: Code Red 2 attack
Date Fri, 01 Mar 2002 09:33:59 GMT
Is there a specific place to put this in the conf file? Everytime I put it
in the httpd.conf file, and restart apache it failed to restart. I delete
the code, save and restart and it works again....

thanx!

----- Original Message -----
From: "Erwien Samantha Y" <erwiensamantha@netscape.net>
To: <users@httpd.apache.org>
Sent: Friday, March 01, 2002 1:24 AM
Subject: Re: Code Red 2 attack


> add this in httpd.conf
>
> ##############################################
> ##### Remove IIS worm From LOG ###############
> #############################################
> SetEnvIfNoCase Request_URI "^/scripts/"  nolog
> SetEnvIfNoCase Request_URI "^/msadc/"    nolog
> SetEnvIfNoCase Request_URI "^/MSADC/"    nolog
> SetEnvIfNoCase Request_URI "^/_vti_bin/" nolog
> SetEnvIfNoCase Request_URI "^/_mem_bin/" nolog
> SetEnvIfNoCase Request_URI "^/c/winnt/"  nolog
> SetEnvIfNoCase Request_URI "^/d/winnt/"  nolog
> SetEnvIfNoCase Request_URI "^/default.ida" nolog
> Redirect gone /scripts/
> Redirect gone /msadc/
> Redirect gone /MSADC/
> Redirect gone /_vti_bin/
> Redirect gone /_mem_bin/
> Redirect gone /c/winnt/
> Redirect gone /d/winnt/
> Redirect gone /default.ida
>
> CustomLog /www/logs/access_log combined env=!nolog
>
> regards,
>
> wIEn.
>
>
> alexblundell@btinternet.com wrote:
>
> >I have a;so had the same problem, On my first box it started in January
and
> >apeares every 10 minutes in my logs. AND on my new box that has only been
up
> >a few weeks its in my logs about 4 times?
> >
> >[Wed Feb 27 13:21:18 2002] [error] [client 216.12.204.122] File does not
> >exist: /var/www/html/MSADC/root.exe
> >[Wed Feb 27 13:21:24 2002] [error] [client 216.12.204.122] File does not
> >exist: /var/www/html/c/winnt/system32/cmd.exe
> >
> >Can anyone explain this???
> >AJ
> >
> >----- Original Message -----
> >From: "Bill -OSX- Jones" <sneex@mac.com>
> >To: <users@httpd.apache.org>
> >Sent: Thursday, February 28, 2002 11:32 PM
> >Subject: Re: Code Red 2 attack
> >
> >
> >>busy - but I do know about the problem - anyhow, I apologize, I
> >>didn't intend to imply this isn't a problem for some Apache admins.
> >>
> >>On Thursday, February 28, 2002, at 06:06  PM, Frank Reichenbacher wrote:
> >>
> >>>Where have you been?
> >>>
> >>>My logs are full of probes from both the Nimda and Code Red worms
> >>>and have
> >>>been ever since they hit the streets last fall. I get hit every
> >>>few seconds
> >>>by infected computers on my ISP's network. These servers have been
> >>>infected
> >>>for many months and their admins are doing nothing about it.
> >>>
> >>
> >>But as I don't do Windows, I guess I never really cared.  So, to me,
> >>it is really an issue of how fast can I ignore those requests...
> >>_Sx____________________
> >>  ('>    -Sx- IUDICIUM
> >>  //\   Have Computer -
> >>  v_/_    Will Hack...
> >>
> >>
> >>---------------------------------------------------------------------
> >>The official User-To-User support forum of the Apache HTTP Server
Project.
> >>See <URL:http://httpd.apache.org/userslist.html> for more info.
> >>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> >>For additional commands, e-mail: users-help@httpd.apache.org
> >>
> >
> >
> >---------------------------------------------------------------------
> >The official User-To-User support forum of the Apache HTTP Server
Project.
> >See <URL:http://httpd.apache.org/userslist.html> for more info.
> >To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> >For additional commands, e-mail: users-help@httpd.apache.org
> >
>
> --
> -==  HonesT Is The BesT PoLicY ==-
>          -----------------
>
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message