REOT RE: [cobalt-users] OT Code Red variations

["Mike Lunn" <mlunn@xxxxxxxxx>]

I use CarrieB script and made the following  PHP Code

$accesslog="/var/log/httpd/access";

echo "<b>This sytem has been attacked today by the Code Red worm a total of
:";
system("cat ". $accesslog . " | grep default.ida | wc -l");
print " times.<br>";
print "<PRE><font size='2'>";
print  system("cat ". $accesslog . "| grep default.ida | awk '{print $2}' |
sort | uniq ") . "<BR>\n";
print "</PRE>";
print "<br><br>Out of the above number a total of ";
system("cat ". $accesslog . " | grep default.ida | awk '{print $2}' | sort |
uniq | wc -l ");
print " were from unquie ips.<br>";


I don't have to ssh in to see how bad I am being hit.  Gave up moving them
all to hosts.deny.


>A few, i sorted them the other day for giggles, I know a fellow eho has
>gotten 40K hits, he got bored and made default.ida a hit counter page to
>count them...lol


Mike