Re: Tracking down the still infected hosts

From: Duncan Hill (dhillat_private)
Date: Tue Sep 25 2001 - 14:05:53 PDT

  • Next message: Josh Burroughs: "Re: Tracking down the still infected hosts"

    On Tue, 25 Sep 2001, Dale Lancaster wrote:
    
    > [Tue Sep 25 16:33:41 2001] [error] [client 199.26.11.171] File does not
    > exist: /some/where/html/_vti_bin/shtml.exe/_vti_rpc
    >
    > It may just be some misconfiguration in our site, but the shtml.exe
    > seems to point to something else since we don't use .exe stuff on
    > our site.  These are flooding my site, but we get lots of them over
    > a day.
    
    Frontpage for *nix uses shtml.exe.  Possibly an attack.
    
    -- 
    
    Sapere aude
    My mind not only wanders, it sometimes leaves completely.
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Sep 25 2001 - 14:19:42 PDT