CODE RED WORM on the increase again?

I know its that time of the month again, CODE RED infected machines are now in their infectious cycle, but it seems as if I am seeing more infected machines hit mine than normal. Anyone else seeing this?

I run a grep across all httpd-access logs on my machine daily to pull out instances of the CODE RED signature:

168.160.17.229 - - [04/Jul/2002:02:56:49 -0700] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3 %u7801%u
9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 328 "-" "-"


grep "GET /default.ida?NNNNNNN" httpd-access.log will do.

Seeing more than normal...

 

 

 

 

Top