Subj : Apache 1.3.22 up but? To : Mike Luther From : mark lewis Date : Wed Oct 31 2001 03:39 pm ML> Instantly .. about a quarter of a meg a day even on this DHCP ML> address of logs similar to: ML> 208.180.221.87 - - [26/Oct/2001:20:15:43 +0000] "GET ML> /scripts/root.exe?/c+dir HTTP/1.0" 404 280 ML> 208.180.221.87 - - [26/Oct/2001:20:15:44 +0000] "GET ML> /MSADC/root.exe?/c+dir ML> HTTP/1.0" 404 278 welcome to the world of the NIMDA worm attempting to infect your server <> there are a few tricks to handle this... however, the standard 404 page is ok, too... unless you can block on ip packet contents, this'll be with us for a while... ML> Of course all the 208.180.###.### are coming from my COX IP's ML> dominion! But gee, maybe I ought to let them suffer instead ML> of asking IJFIRE to dump dis and dat and having to constantly ML> re-write the dump matrix stuff? i'd be firing off reports to cos letting them know the address and what its doing... it should be up to them to determine who has that connection and notify them (as well as knocking them off the net until they get their stuff cleaned up and patched properly)... [trim] ML> Equally important from an OS2INET standpoint, just what ML> methodology does one use with our available OS/2 tools for net ML> connectivity to keep a joint BBS and INET server presence up ML> mission critical style? i let injoy start and stop my apache server when it connects and when i specifically click on the hangup button... other than that, if i have to get off the net, i simply unplug the phone line and stop injoy from dialing out... i use a script to determine if my apache is already up and if it is not, i start it... i also do this with my "DDNS" updater program... )\/(ark * Origin: (1:3634/12) .