tkerns wrote:
>
> I see these also but from external IP addresses.... is this
> from someone just looking at my web pages that has an
> infectted computer, or is this an attack by someone trying
> to gain access? Thanks
These are mindless automated attempts by already-infected Windows boxes trying to infect your server. As you're running Linux and not Windows and your box is presumably otherwise well secured you've nothing to worry about.
These attempts not directed specifically at you or your server(s), they're generally not heavy enough to cause any network traffic or server load issues, these days they're just constant background noise.
If these attacks were to come from a machine within your network you should track it down and clean it up. For outside machines if you're motivated you can track down their owner or contact their ISP but frankly most of us have given up and assume these folks will come to their own bad ends, deserving or not.
In the meantime I'll point out you can find out everything about these by simply entering them as search keys in Google or whatever you like for a search engine. Indeed this is good strategy for many otherwise mysterious log entries where nearly always someone else has already asked the same question and gotten a comprehensive answer.
Nimda, Code Red, et all are not new and are widely and very well documented.
7 Replies
743 Views