CR worm infection attempts

Top Page
Attachments:
Message as email
+ (text/plain)
Delete this message
Reply to this message
Author: Craig White
Date:  
Subject: CR worm infection attempts
Wayne Conrad wrote:
>
> On Sun, 05 August 2001, "J.Francois" wrote:
> > I got tired of counting and just started putting the info into my IDS page.
> > That way I can send complaints and point them to a URL so I don't have to
> > keep recreating the same data each time.
>
> Are you putting the IP's up too?  Every one of the CRII infected boxes is rooted...  I wonder about the goodness of publishing a list of known rooted boxes.
>     Wayne

________________________________________________

I've been trying that out

telnet ipaddress_from_my_httpd_access_log 80

GET /scripts/root.exe HTTP/1.0

but I can't get a command prompt - what am I missing?

Craig