[rescue] New worm?

[Greg A. Woods]

[ On Wednesday, September 19, 2001 at 22:42:00 (-0500), Bill Bradford wrote: ]
> Subject: Re: [rescue] New worm?
>
> bash-2.03$ grep cmd.exe combined_log |wc -l
>     5776
> 
> Thats 3 days.

That's over-stating the number of scans by almost an order of magnitude.

Every scan contains at least several hits for cmd.exe:

$ fgrep MSADC/root.exe /var/log/httpd/access_log | wc -l
     632

$ fgrep cmd.exe /var/log/httpd/access_log | wc -l  
    5551

(even just "root.exe" is appears twice per scan....)

-- 
							Greg A. Woods

+1 416 218-0098      VE3TCP      <gwoods at acm.org>     <woods at robohack.ca>
Planix, Inc. <woods at planix.com>;   Secrets of the Weird <woods at weird.com>