Member Panel

achilles · 10:54 PM

Hi everybody.

Does anyone know where I can read more about the "Morfeus Scanner"?

I read somewhere that "MFS" only affect PHP enabled web servers. I don't have php on my IIS 5 (XP SP3) but I develop ASP.Net and I have .Net 2,3,3.5 enabled on my IIS; do I have to worry about this?

Yesterday I installed "WebLog Expert Lite" (a log parser) on my PC to see when my boss checks my work on my IIS; but I realized my IIS gets hit once a day and just one hit.

The geoIP shows the IP (209.164.12.52) resides in the USA... I have no idea what I should think...

Thanks in advance

---Edit
I think I have to re-think about Iran's filtering though...

Arctos

The link goes to a blog that has a fix for the MFS malware.

http://ekle.us/index.php/2007/05/upd...******_scanner

Replace the the asterisks with the second word of the malware.

I will pm you a Google search listing for this.

Edit:

Here's the php code fix from that site if you cannot get to it...

Code:

# Start of .htaccess change.
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^Morfeus
RewriteRule ^.*$ - [F]
# End of .htaccess change.

He said, I've added this fix to my site's .htaccess file.

achilles

Thanks for the reply

Does ".htaccess" rules apply to IIS too? I thought it was for Apache...
Does this scanner have anything to do with Url_ReWriting or your code uses the urlrw just to check the client's browser?

Arctos

Originally Posted by achilles

Thanks for the reply
Does ".htaccess" rules apply to IIS too? I thought it was for Apache...
Does this scanner have anything to do with Url_ReWriting or your code uses the urlrw just to check the client's browser?

I do not know as I do not have any experience in that field. I just found the link and a fix...

Jelly Bean

Hello,I am not sure if clicking on the "Prework" link below in red on my signiture will help but it may work.