RE: [cobalt-users] [RaQ4] The main web server appears to be down

[<support@xxxxxxxxxxxxx>]

Hi,

Ok, thanks for the reply.
Could this cause the machine to stop working every now and then or coudl it
be caused by anything else?
The machine does not respond to the httpd, ssh, ftp requests, nor does it
respond on pings from What's Up Gold?

regards

Erik Venema
DutchNet

-----Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Graeme Fowler
Sent: woensdag 12 september 2001 17:31
To: 'cobalt-users@xxxxxxxxxxxxxxx'
Subject: RE: [cobalt-users] [RaQ4] The main web server appears to be
down


Erik wrote:

> Just some extra info from the access.log
> We found a lot of messages like this;
>
> www.domain.com 193.98.32.211 - - [10/Sep/2001:07:53:30 +0200] "GET
> /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
<snip>

It's a machine infected with CodeRed vII attempting to connect to port 80 on
your machine and pump the shellcode into it. Since your machine is a RaQ
running Apache it's nothing to worry about.

Graeme
--
Graeme Fowler
System Administrator
Host Europe Group PLC

_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To Subscribe or Unsubscribe, please go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users