Web server logs

Hacking attempts?

[biggles]

Can someone please tell me what it means when your server logs show there have been repeat accesses as below.

66.171.37.47 - - [24/Nov/2002:12:07:18 -0600] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 9236
66.171.37.47 - - [24/Nov/2002:12:07:18 -0600] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 9236
66.171.37.47 - - [24/Nov/2002:12:07:18 -0600] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 9236
66.171.37.47 - - [24/Nov/2002:12:07:18 -0600] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 9236
and so on...

Is this a hacking attempt? A LookUp of the IP address: 66.171.37.47 shows Host name: 47.37.171.66.subscriber.vzavenue.net

Thanks

[jdMorgan]

biggles,

No, this is just some Code Red or NIMDA-infected machine trying to spread the worm to your server. If you're on Apache, you can ignore these. If not, blocking accesses to any resource whose name contains "cmd.exe" will take care of 99% of it.

If you're lucky, you'll get only dozens of these per day. If you're not, more.

Jim

[biggles]

Phew...thanks for the reassurance Jim. Pleased to say my host uses Apache. :)