Re: Reject Nimda Worm request

[davidlfliang]

Just recently, my server (NT 4.0/IIS 4) has received some strange requests in the

http://www log

files.
After some research, I'm sure the requests were made from the NIMDA worm. I checked source IP addresses.

They are from different countries all over world. my server has the latest service pack and firewall proteciton.
Also, after more checking, I'm sure my server is not affected. This is not a problem.

However, my problem is:
My server is connected via DSL line to my isp and they charge us based on the traffic on both directions.
This means any request made from outside world to our server, we need to pay for this traffic.

Then, my sever receives these worm generated requests(nomally 16 requests together in each group, 5 or 6 groups per day) everyday,
I think all these requests contribute to the traffic workload.

How could we solve this problem?

Any suggestion will be welcomed.

Thanks in advance

David Liang

 

[Teamaker]

I would be tempted to contact your ISP as even if you configure your firewall to drop these packets they will still be passing through your ISP.

It sounds a bit out of your control.