HOW TO MANAGE LOG FILES (AND STATISTICS) CORRUPTED BY WORMS ATTACKS ?
PROBLEM: My site is attacked by some worms viruses (like Nimba, Code Red…). This make my log file corrupted and full of 404 errors. So my statistics are also full of 404 errors. This make AWStats slower and my history files very large. Can I do something to avoid this ? SOLUTION: Yes. ‘Worms’ attacks are infected browsers, robots or server changed into web client that make hits on your site using a very long unknown URL like this one: /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%40%50…%40%50 URL is generated by the infected robot and the purpose is to exploit a vulnerability of the web server (In most cases, only IIS is vulnerable). With such attacks, you will will always find a ‘common string’ in those URLs. For example, with Code Red worm, there is always default.ida in the URL string. Some other worms send URLs with cmd.exe in it. With 6.
