Re: CodeRed wormcatcher found on the net

From: Lincoln Yeoh (lyeoh@pop.jaring.my)
Date: 08/27/01 

Message-Id: <3.0.5.32.20010827100554.0096f320@192.228.128.13>
Date: Mon, 27 Aug 2001 10:05:54 +0800
To: Martin Markgraf <mm@rien-ag.de>, vuln-dev@securityfocus.com
From: Lincoln Yeoh <lyeoh@pop.jaring.my>
Subject: Re: CodeRed wormcatcher found on the net

At 01:05 PM 24-08-2001 +0200, Martin Markgraf wrote:
>
>Hello,
>
>Attached you will find a interesting perl program I found
>on the net. It's some kind of "wormcatcher" for the CR II
>and I havn't seen it mentioned on the list befor.
>It reads the local webserver logfile and if it find an
>CR II attempt it tries to execute several commands on
>the offending server.

I've always thought about shutting down those servers which scan me, or
those running scanners voluntarily but I figure I'd end up doing jail time :).

So I usually just ignore them.

Cheerio,
Link.

Relevant Pages