Table 125: Configuration Log Entries - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

WORM:NIMDA:SCRIPTS-CMD
WORM:NIMDA:SCRIPTS-ROOT
WORM:PHPINCLUDE:SEARCH-REQ
WORM:SANTY:GOOGLE-SEARCH
WORM:SANTY:INFECT-ATTEMPT
WORM:SMB:DELODER
WORM:SMB:W32-SLACKOR
Configuration Log Entries

Table 125: Configuration Log Entries

Configuration Log Entry Subcategories
Address
Admin
Copyright © 2010, Juniper Networks, Inc.
This signature detects attempts to infect a Microsoft IIS Web
server with the Nimda worm. Nimda may infect other Web
servers by obtaining e-mail addresses and sending a copy
of itself in infected messages using its own SMTP or POP3
server; adding files to a system configured to allow Windows
file shares; or posting an infected HTML e-mail to the Web
server where it can be accessed via HTTP.
This signature detects attempts to infect a Microsoft IIS Web
server with the Nimda worm. Nimda may infect other Web
servers by obtaining e-mail addresses and sending a copy
of itself in infected messages using its own SMTP or POP3
server; adding files to a system configured to allow Windows
file shares; or posting an infected HTML e-mail to the Web
server where it can be accessed via HTTP.
This signature detects the Santy.C worm attempting to find
targets by sending a search request to a Google or Yahoo
search engine.
This signature detects a machine infected with the Santy
worm querying Google to locate new targets for infection.
The source IP of this log is likely infected with a variant of
Santy.
This signature detects a machine infected with the Santy
worm attempting to infect a new target host. The source IP
of this log is likely infected with a variant of Santy.
This signature detects attempts to upload the deloder worm.
This signature also indicates that the worm has already
logged into the system; the deloder worm can upload itself
to the host only after successful login as Administrator
(deloder uses one of 50 default passwords to login).
This signature detects SMB transmissions of the
W32/Slackor worm, which targets file shares. The worm
scans the /16 of the infected host for systems listening on
TCP/445; if a system is found, the worm uses
pre-programmed usernames and passwords to connect to
the $IPC share on the system, copies itself to the C:\sp
directory, and runs its payload.
The Configuration category contains the subcategories shown in Table 125 on page 949:
ScreenOS Message ID
Addresses > Notification >00001
Admin > Notification > 00002
Appendix E: Log Entries
medium sos5.0.0,
sos5.1.0
medium sos5.0.0,
sos5.1.0
medium sos5.1.0
medium sos5.1.0
high sos5.1.0
critical sos5.1.0
high sos5.1.0
949