nimda, etc.
| From: | Bill Rausch | Date: | Fri, 21 Sep 2001 20:48:09 +0000 |
| Subject: | nimda, etc. | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-68209@lists.php.net to get a copy of this message | ||
My web sites, which generally have only a couple of real visitors a
day to run a specific applications, have just been getting hammered
by this stupid nimda and code red stuff. I'm running Linux/Apache/PHP
and have firewalls that filter everything except port 80 so I'm not
worried about any local effects.
What I've done as a public service is to run a "/missing.php" script
that looks like:
<?php
if( strpos( $HTTP_SERVER_VARS["REDIRECT_URL"], ".exe" ) > 0 )
sleep( 300 );if( strpos( $HTTP_SERVER_VARS["REDIRECT_URL"], "default.ida" ) > 0 )
sleep( 300 );header( "HTTP/1.0 404 Not Found" ); echo "404 File Not Found: "; echo $HTTP_SERVER_VARS["REDIRECT_URL"]; ?> I felt that if nothing else I could slow the worm down a little by wasting its time before it races off to the next potential target. Does what I'm doing make any sense or am I all confused? -- Bill Rausch, Software Development, Unix, Mac, Windows Numerical Applications, Inc. 509-943-0861 bill@numerical.com