Default.ida?

I was looking at my access logs for my site and I noticed quite a few unusual requests for this:

http://www.scharlack.com/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXX%25u9090%25u6858%25ucbd3%25u7801%25u909
0%25u6858%25ucbd3%25u7801%25u9090%25u6858%25ucbd3%25u780
1%25u9090%25u9090%25u8190%25u00c3%25u0003%25u8b00%25u531
b%25u53ff%25u0078%25u0000%25u00=a

I had seen this before but today I wondered exactly what it is. After quick google search I found the answer. It is code red.

Code red is a virus which affects Microsoft Windows servers running IIS. Not a problem since this site is hosted on a Linux computer running Apache. All the request would do to my site is generate a 404 error.

The site I linked to above suggested creating a file called ‘defualt.ida’ so you wouldn’t waste bandwidth serving a 404 error. I did just that by typing touch defult.ida at my site’s command line. However, for some reason, a request for http://www.scharlack.com/default.ida would redirect to http://www.scharlack.com/%3e meaning it is looking for a file named ‘>’. So I entered touch ‘>’ and I now have a blank file named ‘>’ on my site. No more 404, as you can see.

I was actually surprised at how many requests there were: a few a day. Quite a few Windows / IIS servers affected. I am glad I am using Linux and Apache. While that is a lot of servers, my bandwidth costs of the requests was fairly minimal and hardly needed all of that fixing.