[imp] Apache errors regarding IMP

Chuck Hagenbuch chuck@horde.org
Mon Oct 21 03:46:31 2002


Quoting Jan Schneider <jan@horde.org>:

> And to be more specific: It's a virus probably contained in a mail
> attachment you opened with imp.
> 
> > > 202.64.220.x - - [20/Oct/2002:21:16:28 +0800] "GET
> >
> /horde/imp/view.php?
thismailbox=INBOX&index=1941&id=2&actionID=113&mime=9d1caf7ffd290b8e7ebeecde
d7496350
> > HTTP/1.1" 200 5894947
> > > 202.64.220.x - - [20/Oct/2002:21:17:09 +0800] "GET
> > /scripts/root.exe?/c+dir HTTP/1.1" 404 295

I doubt it. These requests are separated by half a minute, and the virus 
isn't one propogated by attachments; it's a web server/service scan thing. 
Don't remember the name right now.

-chuck

--
Charles Hagenbuch, <chuck@horde.org>
"People ask me all the time what it will be like living without otters."
 - Google, thanks to Harpers