[olug] Worms!

[Brian Roberson]

This thing is _very_ widespread, just about every web server I have
access to has the suspected query string ( /default.ida?xxxx ) in the
logs.... oddly enough, the worm sets the HTTP_HOST header variable to
www.worm.com !!! So, I have setup www.worm.com virtual hosts on a few
web servers I have control of and wrote a php app that will mirror the
post data back to the sending machine!!! (effectively re-infecting the
sending host with its own worm spreading disease ) Ah, I love crashing
windoze machines!!




---------------------------------------------------------------------
To unsubscribe, e-mail: olug-unsubscribe at bstc.net
For additional commands, e-mail: olug-help at bstc.net