OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Richard Huffman (huffmanrretail.si.edu)
Date: Tue Jan 29 2002 - 03:27:11 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    *
     When code red hit I put the following in my httpd.conf, right before where the ScriptAlias directives are placed:
     
     Redirect permanent /scripts/ http://127.0.0.1/
     Redirect permanent /_vti_bin/ http://127.0.0.1/
     Redirect permanent /_mem_bin/ http://127.0.0.1/
     Redirect permanent /c/winnt/ http://127.0.0.1/
     Redirect permanent /d/winnt/ http://127.0.0.1/
     Redirect permanent /msadc/ http://127.0.0.1/
     Redirect permanent /MSADC/ http://127.0.0.1/
     Redirect permanent /default.ida http://127.0.0.1/
     
    You could add:
     
    Redirect permanent *.exe http://127.0.0.1/

    Just remember not to put up any self-extracting archives on your site. :)
     
    The worm won't turn on itself but it does solve the error log problem.

    >>> "Brian Clifton" <brianomegadm.co.uk> 01/28/02 15:56 PM >>>
    Dear All

    Is there a way to stop apache responding to .exe file requests altogether?