homepage Welcome to WebmasterWorld Guest from 107.21.163.227
register, free tools, login, search, subscribe, help, library, announcements, recent posts, open posts,
Subscribe to WebmasterWorld
Home / Forums Index / Hardware and OS Related Technologies / Website Technology Issues
Forum Library, Charter, Moderators: phranque

Website Technology Issues Forum

    
Serious problems with our site. A virus? A hacker?
Serious problems with our site. A virus? A hacker?
protgers




msg:666874
 1:46 am on Feb 11, 2002 (gmt 0)

Hi!

We are having big problems with our site.

We checked our log-files with Web Trends and noticed that there are many strange entries: visits to directories that do not (or should not?) excist.

Please check the statistics for last january at:
Revised to read
Our log files contain hundreds of entries like:
/scripts/..%5c../winnt/system32/cmd.exe?/c+dir
/scripts/root.exe?/c+dir
/MSADC/root.exe?/c+dir
etc.

The satistics for 2000-2002 are not relevant to this discussion.

Are we under attack by a hacker or is it a virus? I do hope that
somebody can help. Thanks in advance!

Regards,
Peter Rotgers

(edited by: DaveAtIFG at 5:43 pm (utc) on Feb. 11, 2002)

 

4eyes




msg:666875
 1:51 am on Feb 11, 2002 (gmt 0)

I'm no expert, but those requests sure look like the hack attempts that my PC firewall intercepts.

I am not a Microsoft server user, but hopefully someone more knowledgable should be able to advise how to deal with it.

wilderness




msg:666876
 2:20 am on Feb 11, 2002 (gmt 0)

<snip>Please check the statistics for last january at:
URL snipped>

Either a visitor or your site is infected with a virus.

Sorry I don't recall the name of it.

(edited by: DaveAtIFG at 5:41 pm (utc) on Feb. 11, 2002)

lawman




msg:666877
 2:24 am on Feb 11, 2002 (gmt 0)

The first time I saw similar attempts several months ago, I contacted my host who verified that someone is trying to hack into the server. I was told not to worry about it, that they had everything under control. I didn't know whether to believe them or not. I still see the same attmepts, but so far nothing has come of them.

You might want to let your host know about it. Perhaps they can reassure you.

Lawman

bird




msg:666878
 2:29 am on Feb 11, 2002 (gmt 0)

It's been around half a year now. see original thread [webmasterworld.com]

Key_Master




msg:666879
 3:28 am on Feb 11, 2002 (gmt 0)

I get a headache whenever I view a Webtrends report (lack of usable information).

Is that amount of 404 errors normal for your site and if not, can you find out which IPs were making those requests? More specifically, I am curious as to how many of those IP's begin with 64.

sarkye




msg:666880
 9:27 am on Feb 11, 2002 (gmt 0)

these look to me like the lines my log files were rife with a while back... was the nimda virus (??) looking for a way in

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Hardware and OS Related Technologies / Website Technology Issues
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About
© Webmaster World 1996-2014 all rights reserved