How to get rid of annoying MS worm log entries in Apache

320mb · 10-16-2004, 03:27 PM

LMAO..........this is great...........

Quote:

Sick of seeing those irritating IIS worm messages hitting your apache logs thanks to the millions of unpatched machines? Use this method to redirect them to Windows Update Page and simply don't log the attempts.

http://www.digitlcoup.org/papers/conf.html

this is Classic Linux Ingenuity at work...........Kudos to this dude........

Capt_Caveman · 10-17-2004, 11:49 PM

That's a nice way to do it. I had toyed around with redirecting requests like that to some type of questionable content (think goatse), but unfortunately I don't think either way would have the desired effect (I imagine the worm just parses the reply for a status code rather than rendering any of the content (not nearly as fun

)).

In fact, you have to be carefull on how you handle malicious code, as the tools are often written by people who can't code for crap. I once used mod_rewrite to send 403s back to anyone trying to use the "OPTIONS" request method and it turned out that the damn automated scanners would hang and instead of getting a single entry with a 200 status code, I would get several hundred (doh!).