Log Entries & Tracking Culprit

over 100 entries in one day

[Putz]

How do I track this one?

66.70.86.100

This all I could locate...

DataPipe DATAPIPE-BLK3 (NET-66-70-0-0-1)
66.70.0.0 - 66.70.127.255
Armand Rousso DP-66-70-86-100 (NET-66-70-86-100-1)
66.70.86.100 - 66.70.86.109

# ARIN WHOIS database, last updated 2003-06-09 21:05

Plus I got these types of log entires...

"HEAD /_mem_bin/..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"

HEAD /_mem_bin/check.bat/

"HEAD /_vti_bin/

HEAD /a.asp/..%c1%9c../..%c1%9c..\\winnt\\repair\\sam._

HEAD /bin/scripts/

HEAD /cgi/check.bat

HEAD /exchange/check.bat/

HEAD /msadc/

HEAD /PBServer/check.bat/

HEAD /scripts/

HEAD /_mem_bin/check.bat/

There are over 100 different lines from this one numeric url. What are they doing and why? Are they anything to be concerned about?

Thanks for any help, as I'm totally confused. If I placed this in the wrong forum, please let me know, thanks.

[jdMorgan]

Putz,

(LOL)

What you are seeing is the signature of a NIMDA-infected server. It's trying to pass the virus on to your server. If you are on Apache, or on a Windows server with up-to-date patches, then this is nothing more than an annoyance.

I noticed that one of the hosting services I use has taken a clever approach to these requests: Rather than returning the standard 404 or 403 response page, they made up a special blank page, set the server to remove almost all of the HTTP response headers, and then redirected these requests to those stripped-down response pages. The result is that each reply is only a few bytes long, so this conserves server and network bandwidth until they get around to black-holing the offender at the firewall.

You can do something similar using .htaccess at a user-level.

Jim

[Putz]

"You can do something similar using .htaccess at a user-level"

OK, how is that done?

Or should I talk with my host?

[jdMorgan]

Putz,

It's a bit of work, and I haven't done exactly that. However, reference to the Apache mod_rewrite and mod_headers docmentation [httpd.apache.org] should get you going.

The basic idea is to redirect requests for the regular-expressions pattern

cmd\.exe$

to a "special" blank file, and "manually" delete and/or shorten the headerserved with that filename.

If I get some time, I'll play with it. But right now, things are kinda busy, and it's pay, not play, that I have to work on... ;)

HTH,
Jim