[plug] Nimda worm variant ?

[Arie Hol]

Hello Kai

At 09:57 AM 11-02-2003 +0800, you wrote:

>I'm seeing an increasing number of these requests on Apache:
>
>ipd50a324a.speed.planet.nl - - [11/Feb/2003:07:17:10 +0800] "GET 
>/_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=2614&STRMVER=4&CAPREQ=0 HTTP/1.1" 
>404 333

Go to :

http://www.xav.com/scripts/guardian/help/1022.html



>ipd50a324a.speed.planet.nl - - [11/Feb/2003:07:17:12 +0800] "GET 
>/MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=2614&STRMVER=4&CAPREQ=0 HTTP/1.1" 
>404 333
>

As above goto :

http://www.xav.com/scripts/guardian/help/1022.html

>Anyone have any ideas ?

I hope this helps put you on the right track.

Regards Arie

>--------------------------------------------<

For the concert of life, nobody has a program.

>--------------------------------------------<