Error in Apache Log File?

[Ron Brown_2]

I found the following entry when I examined access_log on our web server:

65.73.180.156 - - [16/Jun/2003:13:36:07 -0500] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 276 "-" "-"

Some background: the site was hosted on a Linux box until recently and is now hosted under HP-UX 11.00. The log file was brought over from the Linux server. The Apache 1.3.26 is installed on both machines.

Is this an error, file corruption, or something more sinister?

[Evert Jan van Ramselaar · Accepted solution]

These messages are traces of a worm querying your webserver. See http://www.datarescue.com/fprot/virinfo/defaultida.htm for more info.

Nothing to worry about. These things have become very common.

EJ

[Michael Kelly_5]

Ron,
this is the 'signature' of the Code Red worm.
Last I heard, HPUX wasn't vulnerable!

Regards,
Michael.

[Evert Jan van Ramselaar]

True, only unpatched Microsoft IIS are vulnerable. It's just that the worm is searching for other unpatched IIS servers by trying the mentioned GET command.

EJ

[Steven E. Protter]

I see that on my Linux servers all the time.

Nice to know now why it happens.

You should continue to see this on HP-UX even though hou switched servers.

There should be a way to block these queries, but since they aren't dangerous, you can probably forget them.

If however I can associate an IP addy with this stuff, I'm going to forward it to the FBI, as should any good web hoster.

Someone is not playinig nicely or has been hacked.

SEP

[Ron Brown_2]

I have to apologize for the formatting of the original post.

It's good to know what that is and that HP-UX is not affected.

I will now spend some time analyzing the logs more carefully for any other possible issues. Thanks!