These just came on line. My point was there should eb NO traffic. It's 3MB
of just this.
-----Original Message-----
From: Derek Glidden [mailto:dglidden@illusionary.com]
Sent: Thursday, January 17, 2002 12:43 PM
To: slug@nks.net
Subject: Re: [SLUG] worm log entries
On Wed, 2002-01-16 at 17:48, Patrick Grantham wrote:
> How can I configure Apache to stop logging these entries?
> 66.126.9.103 - - [02/Jan/2002:14:38:01 -0500] "GET
/scripts/root.exe?/c+dir
> HTTP/1.0" 404 300
[etc]
The simple, but incomplete answer is, "Use apache's rewrite engine to
block those accesses entirely." I thought I had a server that had a
bunch of those rewrite rules in place to block stuff like CodeRed and
Nimda, but now I can't figure out where it is, so I can't post the
relevant sections. It's pretty straightforward though.
> In one week the web log file on this machine grew to 3MB in one week, from
> this alone. It just began serving. I know what they are. I can post
> process the log file to discard them, but how can I configure apache to
sto
> logging them?
Heh... a whole 3MB? *snigger* (thinking about our big production web
servers that have racked up 1.5GB of logfiles in a week worth of worm
activity...)
--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
#!/usr/bin/perl -w
$_='while(read+STDIN,$_,2048){$a=29;$b=73;$c=142;$t=255;@t=map
{$_%16or$t^=$c^=($m=(11,10,116,100,11,122,20,100)[$_/16%8])&110;
$t^=(72,@z=(64,72,$a^=12*($_%16-2?0:$m&17)),$b^=$_%64?12:0,@z)
[$_%8]}(16..271);if((@a=unx"C*",$_)[20]&48){$h=5;$_=unxb24,join
"",@b=map{xB8,unxb8,chr($_^$a[--$h+84])}@ARGV;s/...$/1$&/;$d=
unxV,xb25,$_;$e=256|(ord$b[4])<<9|ord$b[3];$d=$d>>8^($f=$t&($d
>>12^$d>>4^$d^$d/8))<<17,$e=$e>>8^($t&($g=($q=$e>>14&7^$e)^$q*
8^$q<<6))<<9,$_=$t[$_]^(($h>>=8)+=$f+(~$g&$t))for@a[128..$#a]}
print+x"C*",@a}';s/x/pack+/g;eval
usage: qrpff 153 2 8 105 225 < /mnt/dvd/VOB_FILENAME \
| extract_mpeg2 | mpeg2dec -
http://www.cs.cmu.edu/~dst/DeCSS/Gallery/
http://www.eff.org/ http://www.anti-dmca.org/
This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 19:10:42 EDT