[lug] Code Rainbow: New attack, MUCH nastier...

[Glenn Murray]

As a newbie to all this I have to grab this opportunity to learn
something: in my /var/log/apache/error.log I see lines like

[Tue Sep 18 10:46:52 2001] [error] [client 64.3.158.34] File does not exist: /var/www/scripts/root.exe
[Tue Sep 18 10:46:55 2001] [error] [client 64.3.158.34] File does not exist: /var/www/MSADC/root.exe
[Tue Sep 18 10:46:59 2001] [error] [client 64.3.158.34] File does not exist: /var/www/c/winnt/system32/cmd.exe

Is this what you all are talking about with this attack?

Thanks for the learnin',
Glenn Murray
www.mines.edu/~gmurray/public_html/Welcome.html

On Tue, 18 Sep 2001, John Starkey wrote:

> root.exe and cmd.exe in apache's error_log is what I was looking at.
>