{"id":20,"date":"2009-12-18T16:51:49","date_gmt":"2009-12-18T07:51:49","guid":{"rendered":"http:\/\/www.psdks.com\/blog\/?p=20"},"modified":"2009-12-18T16:51:49","modified_gmt":"2009-12-18T07:51:49","slug":"apache_log","status":"publish","type":"post","link":"http:\/\/www.psdks.com\/blog\/?p=20","title":{"rendered":"Apache log"},"content":{"rendered":"<div id=\"hdl\"><a href=\"http:\/\/www-ice.yamagata-cit.ac.jp\/ken\/senshu\/sitedev\/index.php?cmd=search&amp;word=Apache%2Flog%A4%CE%C0%DF%C4%EA\">Apache\/log\u306e\u8a2d\u5b9a<\/a> <\/div>\n<div id=\"body\">\n<ul class=\"navi\">\n<li class=\"navi_left\"><a href=\"http:\/\/www-ice.yamagata-cit.ac.jp\/ken\/senshu\/sitedev\/index.php?Apache%2Fhttpd.conf\" title=\"Apache\/httpd.conf (1604d)\">Prev<\/a><\/li>\n<li class=\"navi_right\"><\/li>\n<li class=\"navi_none\"><a href=\"http:\/\/www-ice.yamagata-cit.ac.jp\/ken\/senshu\/sitedev\/index.php?Apache\" title=\"Apache (1633d)\">Apache<\/a><\/li>\n<\/ul>\n<hr class=\"full_hr\">\n<div class=\"contents\">\n<ul class=\"list1\" style=\"padding-left: 16px; margin-left: 16px;\">\n<li><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#content_1_0\"> Apache \u306e\u30ab\u30b9\u30bf\u30e0\u30ed\u30b0\u8a2d\u5b9a<\/a>\n<ul class=\"list2\" style=\"padding-left: 16px; margin-left: 16px;\">\n<li><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#content_1_1\"> \u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a18\u9332\u3057\u306a\u3044<\/a><\/li>\n<li><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#content_1_2\"> \u7279\u5b9a\u306e\u30db\u30b9\u30c8\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a18\u9332\u3057\u306a\u3044<\/a><\/li>\n<li><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#content_1_3\"> Worm \u306e\u30a2\u30af\u30bb\u30b9\u3092\u5225\u30d5\u30a1\u30a4\u30eb\u306b\u8a18\u9332\u3059\u308b<\/a><\/li>\n<li><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#content_1_4\"> W32.HLLW.Gaobot.gen<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<p>(2004-4-7)<\/p>\n<h2 id=\"content_1_0\">Apache \u306e\u30ab\u30b9\u30bf\u30e0\u30ed\u30b0\u8a2d\u5b9a<\/h2>\n<p>\u9577\u671f\u9593\u904b\u7528\u3057\u3066\u3044\u308b\u3068\u3001Apache \u306e\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u306f\u81a8\u5927<a id=\"notetext_1\" href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#notefoot_1\" class=\"note_super\">*1<\/a>\u306b\u306a\u308b\u3002<br \/>\n\u305d\u306e\u4e2d\u306b\u306f\u3001\u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u3084\u81ea\u5206\u306e\u30c7\u30d0\u30c3\u30b0\u6642\u306e\u30a2\u30af\u30bb\u30b9\u3082\u8a18\u9332\u3055\u308c\u308b\u3002<\/p>\n<p>\u3053\u308c\u3089\u306e\u30a2\u30af\u30bb\u30b9\u8a18\u9332\u304c\u4e0d\u8981\u3068\u5224\u65ad\u3057\u3001\u30ed\u30b0\u63a1\u53d6\u3092\u884c\u308f\u306a\u3044\u69d8\u306b\u8a2d\u5b9a\u3059\u308b\u3002<br \/>\n\uff08\u3082\u3061\u308d\u3093\u3001\u30b5\u30a4\u30c8\u306b\u3088\u3063\u3066\u306f\u91cd\u8981\u306a\u60c5\u5831\u3067\u3042\u308b\u3002\uff09<\/p>\n<p>\u63a1\u53d6\u3059\u308b\u30ed\u30b0\u3092\u9650\u5b9a\u3059\u308b\u4e8b\u3067\u30ed\u30b0\u306e\u5185\u5bb9\u3092\u89e3\u6790\u3057\u3084\u3059\u304f\u306a\u308b\u306e\u306f\u4e8b\u5b9f\u3067\u3042\u308b\u3002<br \/>\n\u5de5\u592b\u6b21\u7b2c\u3067\u306f\u3001\u7121\u7528\u306e\u30ed\u30b0\u3092\u8a18\u9332\u3059\u308b\u5fc5\u8981\u304c\u306a\u304f\u306a\u308a\u30d1\u30d5\u30a9\u30fc\u30de\u30f3\u30b9\u3082\u5411\u4e0a\u3059\u308b\u304b\u3082\u3057\u308c\u306a\u3044\u3002<\/p>\n<div class=\"jumpmenu\"><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#navigator\">\u2191<\/a><\/div>\n<h3 id=\"content_1_1\">\u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a18\u9332\u3057\u306a\u3044<\/h3>\n<p>Apache \u306e\u30ed\u30b0\u306f\u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u3082\u8a18\u9332\u3059\u308b\u3002<br \/>\n\u30b5\u30a4\u30c8\u306b\u3088\u3063\u3066\u306f\u91cd\u8981\u306a\u60c5\u5831\u3060\u304c\u3001\u4e0d\u8981\u3068\u5224\u65ad\u3067\u304d\u308b\u5834\u5408\u3082\u591a\u3044\u3002<\/p>\n<p>\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u30ed\u30b0\u8a2d\u5b9a\u306e\u307e\u307e\u3060\u3068\u3001\u300c index.html \u300d\u306b\u300c 001.gif \u300d\u3068<br \/>\n\u300c002.gif \u300d\uff12\u3064\u306e\u753b\u50cf\u304c\u3042\u308b\u5834\u5408\u3001\u30ed\u30b0\u306f\u4ee5\u4e0b\u306e3\u884c\u306b\u306a\u308b\u3002<\/p>\n<blockquote>\n<p class=\"quotation\">999.99.99.99 &#8211; &#8211; [27\/Jul\/2003:04:03:48<br \/>\n+0900] &#8220;GET \/index.html HTTP\/1.1&#8221; 200 6826 &#8220;-&#8221; &#8220;Mozilla\/4.0<br \/>\n(compatible; MSIE 6.0; Windows NT 5.0)&#8221;<\/p>\n<p class=\"quotation\">999.99.99.99 &#8211; &#8211; [27\/Jul\/2003:04:03:49 +0900] &#8220;GET<br \/>\n\/001.gif HTTP\/1.1&#8221; 200 38430 &#8220;-&#8221; &#8220;Mozilla\/4.0 (compatible; MSIE 6.0;<br \/>\nWindows NT 5.0)&#8221;<\/p>\n<p class=\"quotation\">999.99.99.99 &#8211; &#8211; [27\/Jul\/2003:04:03:49 +0900] &#8220;GET<br \/>\n\/002.gif HTTP\/1.1&#8221; 200 44816 &#8220;-&#8221; &#8220;Mozilla\/4.0 (compatible; MSIE 6.0;<br \/>\nWindows NT 5.0)&#8221;<\/p>\n<\/blockquote>\n<p>\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u306e\u80a5\u5927\u5316\u3092\u9632\u3050\u305f\u3081\u3001\u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u5bfe\u3057\u3066\u30ed\u30b0\u306b<br \/>\n\u8a18\u9332\u3057\u306a\u3044\u8a2d\u5b9a\u306b\u3059\u308b\u3002<\/p>\n<p>\u3053\u3053\u3067\u306f\u3001\u300c mod_setenvif \u300d\u3068\u3044\u3046\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u4f7f\u7528\u3059\u308b\u3002<br \/>\n\u5ff5\u306e\u305f\u3081 httpd.conf \u306b\u4ee5\u4e0b\u306e\u8a18\u8ff0\u304c\u3042\u308b\u4e8b\u3092\u78ba\u8a8d\u3059\u308b\u3002<\/p>\n<pre>LoadModule setenvif_module modules\/mod_setenvif.so<br \/>AddModule mod_setenvif.c<\/pre>\n<p>Windows\u3067\u306f\u3001AddModule \u306e\u8a18\u8ff0\u306f\u4e0d\u8981\u3002<br \/>\nhttpd.conf \u306e\u4e2d\u306b\u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u306e\u30ed\u30b0\u63a1\u53d6\u306b\u95a2\u3059\u308b\u4ee5\u4e0b\u306e\u8a18\u8ff0\u3092\u8ffd\u52a0\u3059\u308b\u3002<br \/>\n\u74b0\u5883\u5909\u6570\u300c no_log \u300d\u306e\u884c\u306b\u306f\u30ed\u30b0\u63a1\u53d6\u3057\u306a\u3044\u30d5\u30a1\u30a4\u30eb\u306e\u62e1\u5f35\u5b50\u3092\u8a18\u8ff0\u3059\u308b\u3002<\/p>\n<pre>SetEnvIf Request_URI \"\\.(gif)|(jpg)|(png)$\" no_log<\/pre>\n<p>\u8ffd\u52a0\u3059\u308b\u5834\u6240\u306f Addmodule \u4ee5\u4e0b\u306a\u3089\u3069\u3053\u3067\u3082\u69cb\u308f\u306a\u3044\u304c\u3001LogFormat \u3084<br \/>\nCustomLog \u306e\u8a18\u8ff0\u304c\u3042\u308b\u8fba\u308a\u3078\u306e\u8a18\u8ff0\u3092\u85a6\u3081\u308b\u3002<\/p>\n<p>\u6b21\u306b CustomLog \u306b\u95a2\u3059\u308b\u8a18\u8ff0\u3092\u7de8\u96c6\u3059\u308b\u3002<\/p>\n<pre>\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u8a18\u8ff0<br \/>CustomLog logs\/access.log combined<br \/>   \u2193<br \/>CustomLog logs\/access.log combined env=!no_log<\/pre>\n<p>\u8a2d\u5b9a\u304c\u3067\u304d\u305f\u3089\u3001Apache \u3092\u518d\u8d77\u52d5\u3057\u3001\u5909\u66f4\u3092\u53cd\u6620\u3055\u305b\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u69d8\u306b\u8a18\u8ff0\u3092\u5909\u66f4\u3059\u308b\u4e8b\u3067\u3001\u74b0\u5883\u5909\u6570\u300c no_log \u300d\u3067\u6307\u5b9a\u3057\u305f\u3082\u306e\u3092\u4ee5\u5916\u306e<br \/>\n\u30ed\u30b0\u63a1\u53d6\u3059\u308b\u3088\u3046\u306b\u306a\u308b\u3002<\/p>\n<div class=\"jumpmenu\"><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#navigator\">\u2191<\/a><\/div>\n<h3 id=\"content_1_2\">\u7279\u5b9a\u306e\u30db\u30b9\u30c8\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a18\u9332\u3057\u306a\u3044<\/h3>\n<p>Apache \u306e\u30ed\u30b0\u306b\u306f\u5168\u3066\u306e\u30a2\u30af\u30bb\u30b9\u306b\u5bfe\u3057\u3001\u30ed\u30b0\u63a1\u53d6\u3092\u884c\u3046\u3002<br \/>\n\u81ea\u5206\u304b\u3089\uff08\u307e\u305f\u306f\u540c\u4e00 LAN \u5185\uff09\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u306f\u4f59\u308a\u5fc5\u8981\u3067\u306f\u306a\u3044\u306e\u3067\u3001<br \/>\n\u30ed\u30b0\u3092\u8a18\u9332\u3057\u306a\u3044\u69d8\u306b\u8a2d\u5b9a\u3059\u308b\u3002<\/p>\n<p>httpd.conf \u4e2d\u306e LogFormat \u3084 CustomLog \u306e\u8a18\u8ff0\u304c\u3042\u308b\u8fba\u308a\u306b\u4ee5\u4e0b\u306e\u8a18\u8ff0\u3092\u8ffd\u52a0\u3059\u308b\u3002<\/p>\n<pre>SetEnvIf Remote_Addr 192.168.0. no_log<br \/>CustomLog logs\/access_log combined env=!no_log<\/pre>\n<p>\u3053\u3046\u3059\u308b\u4e8b\u306b\u3088\u308a 192.168.0.* \u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u306f\u4e00\u5207\u30ed\u30b0\u3092\u8a18\u9332\u3057\u306a\u3044\u3002<br \/>\n\u524d\u9805\u306e\u300c \u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a18\u9332\u3057\u306a\u3044 \u300d\u306e\u4e2d\u306e<br \/>\n\u74b0\u5883\u5909\u6570\u3067\u3042\u308b\u300c no_log \u300d\u3068\u540c\u4e00\u3067\u3059\u3002<br \/>\n\u4ee5\u4e0b\u306e\u69d8\u306b\u8a18\u8ff0\u3059\u308b\u3068\u3001\uff12\u3064\u306e SetEnvIF \u306e\u5185\u5bb9\u304c\u53cd\u6620\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre>SetEnvIf Request_URI \"\\.(gif)|(jpg)|(png)$\" no_log<br \/>SetEnvIf Remote_Addr 192.168.0. no_log<br \/>CustomLog logs\/access.log combined env=!no_log<\/pre>\n<div class=\"jumpmenu\"><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#navigator\">\u2191<\/a><\/div>\n<h3 id=\"content_1_3\">Worm \u306e\u30a2\u30af\u30bb\u30b9\u3092\u5225\u30d5\u30a1\u30a4\u30eb\u306b\u8a18\u9332\u3059\u308b<\/h3>\n<p>\u4e0a\u8a18\u306e\u65b9\u6cd5\u3092\u5229\u7528\u3057\u3066\u3001Worm \u306e\u30ed\u30b0\u3092\u5225\u306e\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u306b\u63a1\u53d6\u3059\u308b\u4e8b\u3082\u53ef\u80fd\u3067\u3042\u308b\u3002<br \/>\n\u3053\u3053\u3067\u306f\u3001\u5148\u8ff0\u306e\u753b\u50cf\u306b\u95a2\u3059\u308b\u4e8b\u3068\u3001\u7279\u5b9a\u306e\u30db\u30b9\u30c8\u306b\u95a2\u3059\u308b\u30ed\u30b0\u3068\u3082\u4f75\u305b\u3066\u8a18\u8ff0<br \/>\n\u3057\u3066\u307f\u305f\u3002<\/p>\n<pre># \u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u30ed\u30b0\u63a1\u53d6\u3092\u3057\u306a\u3044<br \/>SetEnvIf Request_URI \"\\.(gif)|(jpg)|(png)$\" no_log<br \/># \u7279\u5b9a\u306e\u30db\u30b9\u30c8\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u306f\u30ed\u30b0\u63a1\u53d6\u3057\u306a\u3044<br \/>SetEnvIf Remote_Addr 192.168.0. no_log<br \/><br \/># Worm \u306b\u95a2\u3059\u308b\u30ed\u30b0\u306f\u5225\u30d5\u30a1\u30a4\u30eb\u306b\u8a18\u9332\u3057\u307e\u3059<br \/>SetEnvIf Request_URI \"\\.(ida|IDA|exe|printer|asp|dll)\" no_log<br \/><br \/>SetEnvIf Request_URI \"^\/_mem_bin\/\" worm no_log<br \/>SetEnvIf Request_URI \"^\/_vti_bin\/\" worm no_log<br \/>SetEnvIf Request_URI \"^\/c\/\" worm no_log<br \/>SetEnvIf Request_URI \"^\/d\/\" worm no_log<br \/>SetEnvIf Request_URI \"^\/msadc\/\" worm no_log<br \/>SetEnvIf Request_URI \"^\/MSADC\/\" worm no_log<br \/>SetEnvIf Request_URI \"^\/scripts\/\" worm no_log<br \/>SetEnvIf Request_URI \"^\/default.ida\" worm no_log<br \/>SetEnvIf Request_URI \"root\\.exe\" worm no_log<br \/>SetEnvIf Request_URI \"cmd\\.exe\" worm no_log<br \/>SetEnvIf Request_URI \"NULL\\.IDA\" worm no_log<br \/><br \/># no_log \u306b\u8a72\u5f53\u3057\u306a\u3044\u3082\u306e\u3092 access_log \u306b\u8a18\u9332<br \/>CustomLog logs\/access.log combined env=!no_log<br \/><br \/># worm \u306b\u8a72\u5f53\u3059\u308b\u3082\u306e\u3092 worm_log \u306b\u8a18\u9332<br \/>CustomLog logs\/worm.log combined env=worm<\/pre>\n<hr class=\"full_hr\">\n<pre>#----- \u30a8\u30e9\u30fc\u3092\u8a18\u9332\u3059\u308b\u30ec\u30d9\u30eb<br \/>LogLevel warn<br \/>#----- \u30ed\u30b0\u5f62\u5f0f<br \/>LogFormat \"%h %l %u %t \\\"%r\\\" %&gt;s %b \\\"%{Referer}i\\\" \\\"%{User-Agent}i\\\"\"  combined<\/pre>\n<pre>#----- \u74b0\u5883\u5909\u6570\u306e\u8a2d\u5b9a<br \/>SetEnvIf Request_URI \"\\.(ida|IDA|exe|printer|asp|dll)\" no_log<br \/>SetEnvIf Request_URI \"\\.(gif|jpg|png|css|ico)$\" no<br \/>SetEnvIf Remote_Addr \"^192\\.168\\.[0-9]+\\.[0-9]+$\" no_log<\/pre>\n<pre>#----- \u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u306e\u4f4d\u7f6e<br \/>CustomLog logs\/axs.log combined env=!no_log<br \/>CustomLog logs\/no.log combined env=no_log<br \/>ErrorLog  logs\/error.log <\/pre>\n<div class=\"jumpmenu\"><a href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#navigator\">\u2191<\/a><\/div>\n<h3 id=\"content_1_4\">W32.HLLW.Gaobot.gen<\/h3>\n<p><a href=\"http:\/\/www.symantec.com\/region\/jp\/sarcj\/data\/w\/w32.hllw.gaobot.gen.html\">http:\/\/www.symantec.com\/region\/jp\/sarcj\/data\/w\/w32.hllw.gaobot.gen.html<\/a><\/p>\n<p>\u4e00\u56de\u306e\u30a2\u30af\u30bb\u30b9\u3067 32KB\uff01 \u3068\u3044\u3046\u6050\u308d\u3057\u304f\u9577\u5927\u306a\u30ed\u30b0\u3092\u6b8b\u3059\u4e0d\u5177\u5408<\/p>\n<pre>218.XXX.XXX.79 - - [01\/Apr\/2004:09:56:17 +0900] \"SEARCH \/\\x90 ...<br \/>\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02 ...(\u4e2d\u7565)... <br \/>\\x90\\x90\\x90\\x90\" 414 271 \"-\" \"-\"  <\/pre>\n<p>\u3053\u3046\u3044\u3046\u30ed\u30b0\u3067\u3059\u30022004\u5e744\u6708\u4ee5\u964d\u3001\u983b\u7e41\u306b\u898b\u304b\u3051\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u3002<br \/>\n\u3053\u306e\u51fa\u73fe\u306b\u3088\u3063\u3066\u3001\u30a2\u30af\u30bb\u30b9\u30ed\u30b0\u306f\u7d042\u500d\u306e\u30da\u30fc\u30b9\u3067\u5897\u52a0\u3059\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u3002W32.HLLW.Gaobot.gen \u3068\u3044\u3046\u540d\u306e\u30ef\u30fc\u30e0\uff1f\u306f\u3001IIS \u30b5\u30fc\u30d0\u306e<br \/>\nWebDAV\u8106\u5f31\u6027\u3092\u72d9\u3063\u305f\u30a2\u30af\u30bb\u30b9\u3068\u306e\u8a71\u3067\u3059\u304c\u3001\u8a73\u7d30\u306f\u4e0d\u660e<a id=\"notetext_2\" href=\"file:\/\/\/Users\/life2\/Desktop\/%E5%90%8D%E7%A7%B0%E6%9C%AA%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A9%E3%83%AB%E3%82%BF%E3%82%99%202\/2008\/09\/index.html#notefoot_2\" class=\"note_super\">*2<\/a>\u3067\u3042\u308b\u3002<\/p>\n<p>\u30b5\u30fc\u30d0\u306e\u30b9\u30c6\u30fc\u30bf\u30b9\u30b3\u30fc\u30c9\u3082&#8221;\u30ea\u30af\u30a8\u30b9\u30c8\u9577\u3059\u304e\uff01&#8221;\u3068\u3044\u3046\u610f\u5473\u306e 414 \u3067<br \/>\n\u3053\u306e\u30ed\u30b0\u306f\u524d\u8ff0\u3057\u305f SetEnvIf \u3067\u30ed\u30b0\u3092\u5206\u3051\u308b\u65b9\u6cd5\u304c\u901a\u7528\u3057\u306a\u3044\u3002<\/p>\n<p>\u5bfe\u5fdc\u7b56\u3068\u3057\u3066\u306f\u3001<\/p>\n<ol class=\"list1\" style=\"padding-left: 16px; margin-left: 16px;\">\n<li>W32.HLLW.Gaobot.gen\u306e\u30a2\u30af\u30bb\u30b9\u30ed\u30b0\u3092\u53d6\u308a\u9664\u304f\u30b7\u30a7\u30eb\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u7528\u610f<\/li>\n<li>\u30c0\u30df\u30fc\u306e\u30d0\u30fc\u30c1\u30e3\u30eb\u30b5\u30fc\u30d0\u3092\u7528\u610f\u3057\u3001\u5bfe\u5fdc\u3059\u308b<\/li>\n<\/ol>\n<p>Windows\u74b0\u5883\u3067\u306f\u30b7\u30a7\u30eb\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u96e3\u3057\u3044\u3057\u3001cron \u3082\u4f7f\u3048\u306a\u3044\u306e\u3067\u3001<br \/>\n2\u756a\u76ee\u306e\u30c0\u30df\u30fc\u306e\u30d0\u30fc\u30c1\u30e3\u30eb\u30b5\u30fc\u30d0\u3092\u7528\u610f\u3057\u3066\u56de\u907f\u3059\u308b\u3002<\/p>\n<p>httpd.conf \u3067<\/p>\n<pre>NameVirtualHost XXX.XXX.XXX.XXX:80<br \/><br \/>#===== \u30c0\u30df\u30fc\u30d0\u30fc\u30c1\u30e3\u30eb\u30db\u30b9\u30c8<br \/><br \/>&lt;VirtualHost XXX.XXX.XXX.XXX:80&gt;<br \/>\tServerName worm<br \/>\tDocumentRoot \/home\/httpd\/worm<br \/>&lt;\/VirtualHost&gt;<br \/><br \/>#===== \u4ee5\u4e0b\u306b\u901a\u5e38\u306e\u30d0\u30fc\u30c1\u30e3\u30eb\u30db\u30b9\u30c8(\u30ed\u30b0\u306f\u5225\u9014\u3001\u8a2d\u5b9a\u306e\u3053\u3068)<br \/>&lt;VirtualHost XXX.XXX.XXX.XXX:80&gt;<br \/>\tServerName www.sample.com<br \/>            :<br \/>            :<br \/>&lt;\/VirtualHost&gt;<\/pre>\n<p>\u3068\u3044\u3046\u98a8\u306b\u3001\u901a\u5e38\u306e\u516c\u958b\u7528\u3068\u30c0\u30df\u30fc\u306e2\u3064\u306e\u30d0\u30fc\u30c1\u30e3\u30eb\u30db\u30b9\u30c8\u3092\u7528\u610f\u3059\u308b\u3002<br \/>\n\/home\/httpd\/worm \u306f\u7a7a\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u5272\u308a\u5f53\u3066\u308b\u3002 \u7279\u306b\u8a18\u8ff0\u3057\u306a\u3044\u4e8b\u9805\u306f<br \/>\n\u7d99\u627f\u3055\u308c\u308b\u305f\u3081\u3001\u30d0\u30fc\u30c1\u30e3\u30eb\u30db\u30b9\u30c8\u56fa\u6709\u306e\u8a2d\u5b9a\u306e\u307f\u3092\u66f8\u3051\u3070\u826f\u3044\u3002<\/p>\n<p>\u30db\u30b9\u30c8\u540d\u3067\u306f\u306a\u304f\u3001IP\u30a2\u30c9\u30ec\u30b9\u3067\u30a2\u30af\u30bb\u30b9\u3057\u3066\u304f\u308b\u3082\u306e\u306f\u3001\u30c0\u30df\u30fc\u306e<br \/>\n\u30d0\u30fc\u30c1\u30e3\u30eb\u30db\u30b9\u30c8\u306b\u632f\u308a\u5206\u3051\u308b\u3002\u3053\u308c\u306b\u3088\u308a\u7121\u7528\u306a\u30a2\u30af\u30bb\u30b9\u3092\u5206\u96e2\u3067\u304d\u308b\u3002<\/p>\n<p>\u6ce8\u610f\u70b9\u3068\u3057\u3066\u3001\u6570\u306f\u5c11\u306a\u3044\u304c\u4e00\u90e8\u30ed\u30dc\u30c3\u30c8\u3084\u901a\u5e38\uff08\u6b63\u898f\uff09\u306e\u30a2\u30af\u30bb\u30b9\u3067\u3082\u3001<br \/>\n\u30db\u30b9\u30c8\u540d\u3067\u306f\u306a\u304fIP\u3067\u30a2\u30af\u30bb\u30b9\u3057\u3066\u304f\u308b\u5834\u5408\u304c\u3042\u308a\u3001\u4e00\u62ec\u3057\u3066\u9664\u5916\u3057\u3066\u306f<br \/>\n\u3044\u3051\u306a\u3044\u5834\u5408\u3082\u3042\u308b\u306e\u3067\u6ce8\u610f\u304c\u5fc5\u8981<br \/>\n(\u3061\u306a\u307f\u306bGoogle\u306f\u3061\u3083\u3093\u3068\u30db\u30b9\u30c8\u540d\u3067\u30a2\u30af\u30bb\u30b9\u3057\u3066\u3044\u308b)\u3067\u3042\u308b\u3002<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Apache\/log\u306e\u8a2d\u5b9a Prev Apache Apache \u306e\u30ab\u30b9\u30bf\u30e0\u30ed\u30b0 &hellip; <a href=\"http:\/\/www.psdks.com\/blog\/?p=20\">\u7d9a\u304d\u3092\u8aad\u3080 <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-20","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/20","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=20"}],"version-history":[{"count":0,"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/20\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.psdks.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}