Serious problems with our site. A virus? A hacker?

[protgers]

Hi!

We are having big problems with our site.

We checked our log-files with Web Trends and noticed that there are many strange entries: visits to directories that do not (or should not?) excist.

Please check the statistics for last january at:
Revised to read
Our log files contain hundreds of entries like:
/scripts/..%5c../winnt/system32/cmd.exe?/c+dir
/scripts/root.exe?/c+dir
/MSADC/root.exe?/c+dir
etc.

The satistics for 2000-2002 are not relevant to this discussion.

Are we under attack by a hacker or is it a virus? I do hope that
somebody can help. Thanks in advance!

Regards,
Peter Rotgers

(edited by: DaveAtIFG at 5:43 pm (utc) on Feb. 11, 2002)

[4eyes]

I'm no expert, but those requests sure look like the hack attempts that my PC firewall intercepts.

I am not a Microsoft server user, but hopefully someone more knowledgable should be able to advise how to deal with it.

[wilderness]

<snip>Please check the statistics for last january at:
URL snipped>

Either a visitor or your site is infected with a virus.

Sorry I don't recall the name of it.

(edited by: DaveAtIFG at 5:41 pm (utc) on Feb. 11, 2002)

[lawman]

The first time I saw similar attempts several months ago, I contacted my host who verified that someone is trying to hack into the server. I was told not to worry about it, that they had everything under control. I didn't know whether to believe them or not. I still see the same attmepts, but so far nothing has come of them.

You might want to let your host know about it. Perhaps they can reassure you.

Lawman

[bird]

It's been around half a year now. see original thread [webmasterworld.com]

[Key_Master]

I get a headache whenever I view a Webtrends report (lack of usable information).

Is that amount of 404 errors normal for your site and if not, can you find out which IPs were making those requests? More specifically, I am curious as to how many of those IP's begin with 64.

[sarkye]

these look to me like the lines my log files were rife with a while back... was the nimda virus (??) looking for a way in