Re: [cobalt-users] C drive hack

["Per M Knutsen" <per.knutsen@xxxxxxxxxxxxxx>]

> >www.adifferentsite.com 66.12.10.51 - - [18/Sep/2001:06:51:16 -0700] "GET
> >/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 302 254 "-"
"-"
>
>
> This one is going to be ugly...I have been hit 6500 times in the last 4
> hours.  I am getting about 50 a minute....

With the number of hits you report, I would assume local machines are
spewing out all this garbage. Maybe your co-lo should take some action to
have the offended Windoze machines shut down?

For those craving more info, see
http://www.trusecure.com/html/tspub/hypeorhot/rxalerts/tsa01024_cid177.shtml

There must be some DoS element to this worm, given all the hits. Has anyone
taken any pre-cautionary steps they would like to share with the group?


Per M Knutsen
http://nethut.no/~pknutsen