Bob Tanner wrote: > Quoting Thomas Eibner (thomas at stderr.net): > >>On Sun, Aug 12, 2001 at 12:18:43AM -0500, Bob Tanner wrote: >> >>>I did a test install of the default.ida perl script and I get the >>> >>> Premature end of script headers: >>> >>Sounds like bad cgi-script to me. >> > > Sure. I'll put it up on Real Time's web site. > > http://www.real-time.com/default.txt > As I have said, this is not going to work. When the real worm hits, Apache sees the garbage in the HTTP request (which is the virus body) and responds with a Bad Request error. It will not run your CGI/Perl/PHP/*anything you put there* unless you hack it to bypass the Bad Request error somehow. Perhaps set up a custom Bad Request page with this script? I know you can customise all error pages, but I dunno if you can put in a CGI... Easiest thing to do is just write a daemon that monitors Apache's access log and responds however you'd like.