Re: Weird stuff in Apache logs... what is this junk?

From: John S. Jacob (jsjacob@iamnota.com)
Date: 10/09/01


Date: Mon, 8 Oct 2001 22:22:54 -0700
From: "John S. Jacob" <jsjacob@iamnota.com>
To: "Rob 'Feztaa' Park" <fezziker@home.com>
Subject: Re: Weird stuff in Apache logs... what is this junk?
Message-ID: <20011008222254.A4355@iamnota.com>


On Thu, Oct 04, 2001 at 10:15:07PM -0600, Rob 'Feztaa' Park wrote:
> Is this some kind of new worm, or is this part of Nimda?

Yes, that's all Nimda. Actually, there should be 16 separate attempts.

http://www.ciac.org/ciac/bulletins/l-144.shtml

-- 
John S. Jacob * mailto:jsjacob@iamnota.com * http://www.iamnota.com/
PGP public key: http://jsjacob.iamnota.com/public_key.txt
   Fingerprint: D410 0485 D86C B387 4909  C811 48B6 29CE AC6A CE17




Relevant Pages

  • Nimda mostly infects /8-locally.
    ... Subject: Nimda mostly infects /8-locally. ... addresses encountered in the logs): ... This means, in particular, that the probability for Nimda to attack ... a host in the same /8 portion of the IP address space is ...
    (Incidents)
  • Re: Publishing Nimda Logs
    ... It's Nimda, and an everyday ... > people to post logs there and stuff like that... ... I don't recommend. ... Health - your guide to health and wellness ...
    (Vuln-Dev)
  • RE: Publishing Nimda Logs
    ... When you notified them the second or third time, ... Nimda removal tools and MS patches? ... Subject: Publishing Nimda Logs ...
    (Focus-Microsoft)
  • Re: Publishing Nimda Logs
    ... both Abuse and Arin Contacts for any IP that it detects. ... Subject: Publishing Nimda Logs ... Health - your guide to health and wellness ...
    (Vuln-Dev)
  • RE: Publishing Nimda Logs
    ... Subject: Publishing Nimda Logs ... It is truly sad that so many people are still infected with Nimda. ... they are attacking other systems. ... this is a computer company. ...
    (Focus-Microsoft)