CR worm infection attempts

[plug-discuss@lists.PLUG.phoenix.az.us]

I have been contemplating writing a script to scan the logs, then go
back to infected machines, and change the wallpaper on the desktop to
something that reads:

HEY STUPID:

YOU ARE INFECTED WITH CODE RED... 

GO FIX YOUR BOX


On Sun, Aug 05, 2001 at 01:56:19PM -0700, J.Francois wrote:
> 
> I got tired of counting and just started putting the info into my IDS page.
> That way I can send complaints and point them to a URL so I don't have to 
> keep recreating the same data each time.
> 
> Besides, once it gets picked up by a serch engine maybe that will shame
> some people to get moving and stop this stupid thing.
> 
> http://www.magusnet.com/ids.html
> 
> 
> So, is any interesting OpenSource stuff going on this weekend?
> 
> 
> On Sun, Aug 05, 2001 at 12:37:42PM -0700, Thomas Mondoshawan Tate wrote:
> > No kidding. I just read your listing and decided to check out my webserver's
> > logs just for fun. Whoo... I've only had my server up for less than 11
> > hours, and I've already had 113 hits from that little bugger. O.o
> > 
> > 
> > On Sun, Aug 05, 2001 at 12:24:40PM -0700, jiva@opnix.com wrote:
> > > Mind you, this is unique infections *per hour*.  I've had well over
> > > 1000 attempts in the last 24 hours.
> > > 
> > > On Sun, Aug 05, 2001 at 12:17:20PM -0700, Jiva DeVoe wrote:
> > > > Here's some fun things... I wrote a little script to watch the rate of
> > > > attempted infection of my box.  The first column is the Day, the
> > > > second column(after the colon) is the hour, and the last column is the
> > > > number of times code-red tried to infect me:
> > > > 
> 
> [snipped]
> 
> > > > On Sun, Aug 05, 2001 at 11:38:00AM -0700, Wayne Conrad wrote:
> > > > > It's working.  Everyone's taking a breather from that last round of messages (whew).  Or tailing Apache logs watching the new looks-like-CR-but-isn't worm.  Fun for the whole family.
> > > > >   Wayne
> > > > > ________________________________________________
> 
> 

--