[Xitami] LOG Filter to remove those log-entries created byhttp-viruses.

Spyman xitami@lists.xitami.org
Tue, 19 Feb 2002 17:20:54 -0500 

This is a multi-part message in MIME format.

------=_NextPart_000_000C_01C1B969.C98DC2A0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

I have seen those before from the Nimda.

I have a Linksys router and these are showing up in that log.

Any ideas what they are trying to do? I have noticed them on and off for
several weeks now. All trying to hit port 8888

All these today are from .jp but usually it is from various countries all at
the same time.

2002/02/19 17:16:11.86 I customer100-192.mni.ne.jp(61.206.100.192) 4579
216.175.65.11 8888

2002/02/19 17:16:15.10 I FLH1Aac029.tky.mesh.ad.jp(211.135.233.29) 1667
216.175.65.11 8888

2002/02/19 17:16:19.11 I cj3162273-a.kkbnj1.kt.home.ne.jp(61.24.65.185) 2733
216.175.65.11 8888

2002/02/19 17:16:20.93 I customer100-192.mni.ne.jp(61.206.100.192) 4579
216.175.65.11 8888

2002/02/19 17:16:21.04 I pc6.nvk-unet.ocn.ne.jp(210.232.129.134) 63526
216.175.65.11 8888

2002/02/19 17:16:22.08 I cj3162273-a.kkbnj1.kt.home.ne.jp(61.24.65.185) 2733
216.175.65.11 8888

2002/02/19 17:16:23.84 I pc6.nvk-unet.ocn.ne.jp(210.232.129.134) 63526
216.175.65.11 8888

2002/02/19 17:16:24.11 I FLH1Aac029.tky.mesh.ad.jp(211.135.233.29) 1667
216.175.65.11 8888

2002/02/19 17:16:28.01 I cj3162273-a.kkbnj1.kt.home.ne.jp(61.24.65.185) 2733
216.175.65.11 8888

2002/02/19 17:16:29.88 I pc6.nvk-unet.ocn.ne.jp(210.232.129.134) 63526
216.175.65.11 8888

2002/02/19 17:16:42.18 O support.ca.com(141.202.248.64) 80 192.168.1.5 3895

2002/02/19 17:16:49.82 O support.ca.com(141.202.248.64) 80 192.168.1.5 3899

2002/02/19 17:16:51.19 I YahooBB218137232028.bbtec.net(218.137.232.28) 18920
216.175.65.11 8888

-----Original Message-----
From: xitami-admin@lists.xitami.org [mailto:xitami-admin@lists.xitami.org]On
Behalf Of buteskin
Sent: Tuesday, February 19, 2002 10:38 AM
To: xitami@lists.xitami.org
Subject: Re: [Xitami] LOG Filter to remove those log-entries created
byhttp-viruses.


infected nimda/codered pc's try to attack you, luckyly you have xitami ! it
does not affect you,
  ----- Original Message -----
  From: Chris Stromberger
  To: xitami@lists.xitami.org
  Sent: Tuesday, February 19, 2002 3:47 PM
  Subject: Re: [Xitami] LOG Filter to remove those log-entries created
byhttp-viruses.


  As a newbie, I've noticed these lines in the log files.  Is this anything
to worry about?

  Eg:

  GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNN.....
  GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?.....
  GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/.....
  GET /c/winnt/system32/cmd.exe?/c

  etc.


  Thanks,
  Chris

  >>> hace_x@yahoo.com 02/19/02 04:14AM >>>
  Hello all,

  To get rid of all the log-entries created by
  http-viruses, I have created a little windows-program
  that processes logfiles and removes those 'dirty'
  log-entries that clogup the xitami-logfile.

  You can view all removed lines and kept lines in the
  program because all lines are copied in the listboxes.

  You can download the program 'logfilter' at:
  http://hace.dyndns.org/files/files.html

  Please first read the logfilter.TXT file for further
  comments.

  If you have questions or suggestions for the program
  please sent those to my email address.

  Hope this helps people who where searching for this
  kind of software and couldn't find it (like myself
  ;-),

  Thanks,
  Hace


  __________________________________________________
  Do You Yahoo!?
  Yahoo! Sports - Coverage of the 2002 Olympic Games
  http://sports.yahoo.com

  --
  Xitami Users Mailing List -- For Xitami support
  To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami


------=_NextPart_000_000C_01C1B969.C98DC2A0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2713.1100" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY style=3D"MARGIN-TOP: 2px; FONT: 8pt MS Sans Serif; MARGIN-LEFT: =
2px"=20
bgColor=3D#ffffff>
<DIV><SPAN class=3D190181822-19022002><FONT size=3D1>I have seen those =
before from=20
the Nimda.</FONT></SPAN></DIV>
<DIV><SPAN class=3D190181822-19022002><FONT =
size=3D1></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D190181822-19022002><FONT size=3D1>I have a Linksys =
router and=20
these are showing up in that log.</FONT></SPAN></DIV>
<DIV><SPAN class=3D190181822-19022002><FONT =
size=3D1></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D190181822-19022002><FONT size=3D1>Any ideas what they =
are trying=20
to do? I have noticed them on and off for several weeks now. All trying =
to hit=20
port 8888</FONT></SPAN></DIV>
<DIV><SPAN class=3D190181822-19022002><FONT =
size=3D1></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D190181822-19022002><FONT size=3D1>All these today are =
from .jp=20
but usually it is from various countries all at the same=20
time.</FONT></SPAN></DIV>
<DIV><SPAN class=3D190181822-19022002><FONT =
size=3D1></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D190181822-19022002><FONT size=3D2>
<P>2002/02/19 17:16:11.86 I customer100-192.mni.ne.jp(61.206.100.192) =
4579=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:15.10 I FLH1Aac029.tky.mesh.ad.jp(211.135.233.29) =
1667=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:19.11 I =
cj3162273-a.kkbnj1.kt.home.ne.jp(61.24.65.185) 2733=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:20.93 I customer100-192.mni.ne.jp(61.206.100.192) =
4579=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:21.04 I pc6.nvk-unet.ocn.ne.jp(210.232.129.134) =
63526=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:22.08 I =
cj3162273-a.kkbnj1.kt.home.ne.jp(61.24.65.185) 2733=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:23.84 I pc6.nvk-unet.ocn.ne.jp(210.232.129.134) =
63526=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:24.11 I FLH1Aac029.tky.mesh.ad.jp(211.135.233.29) =
1667=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:28.01 I =
cj3162273-a.kkbnj1.kt.home.ne.jp(61.24.65.185) 2733=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:29.88 I pc6.nvk-unet.ocn.ne.jp(210.232.129.134) =
63526=20
216.175.65.11 8888</P>
<P>2002/02/19 17:16:42.18 O support.ca.com(141.202.248.64) 80 =
192.168.1.5=20
3895</P>
<P>2002/02/19 17:16:49.82 O support.ca.com(141.202.248.64) 80 =
192.168.1.5=20
3899</P>
<P>2002/02/19 17:16:51.19 I =
YahooBB218137232028.bbtec.net(218.137.232.28) 18920=20
216.175.65.11 8888</P></FONT></SPAN></DIV>
<DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B> =
xitami-admin@lists.xitami.org=20
[mailto:xitami-admin@lists.xitami.org]<B>On Behalf Of=20
</B>buteskin<BR><B>Sent:</B> Tuesday, February 19, 2002 10:38 =
AM<BR><B>To:</B>=20
xitami@lists.xitami.org<BR><B>Subject:</B> Re: [Xitami] LOG Filter to =
remove=20
those log-entries created byhttp-viruses.<BR><BR></FONT></DIV>
<DIV><FONT face=3DArial size=3D2>infected nimda/codered pc's try to =
attack you,=20
luckyly you have xitami ! it does not affect you, </FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV style=3D"FONT: 10pt arial">----- Original Message ----- </DIV>
  <DIV=20
  style=3D"BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: =
black"><B>From:</B>=20
  <A title=3DChris.Stromberger@wnco.com=20
  href=3D"mailto:Chris.Stromberger@wnco.com">Chris Stromberger</A> =
</DIV>
  <DIV style=3D"FONT: 10pt arial"><B>To:</B> <A =
title=3Dxitami@lists.xitami.org=20
  href=3D"mailto:xitami@lists.xitami.org">xitami@lists.xitami.org</A> =
</DIV>
  <DIV style=3D"FONT: 10pt arial"><B>Sent:</B> Tuesday, February 19, =
2002 3:47=20
  PM</DIV>
  <DIV style=3D"FONT: 10pt arial"><B>Subject:</B> Re: [Xitami] LOG =
Filter to=20
  remove those log-entries created byhttp-viruses.</DIV>
  <DIV><BR></DIV>
  <DIV><FONT size=3D1>As a newbie, I've noticed these lines in the log=20
  files.&nbsp; Is this anything to worry about?</FONT></DIV>
  <DIV><FONT size=3D1></FONT>&nbsp;</DIV>
  <DIV><FONT size=3D1>Eg:</FONT></DIV>
  <DIV><FONT size=3D1></FONT>&nbsp;</DIV>
  <DIV>GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNN.....</DIV>
  <DIV>GET=20
  =
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?.....</DIV=
>
  <DIV>GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/.....</DIV>
  <DIV>GET /c/winnt/system32/cmd.exe?/c</DIV>
  <DIV>&nbsp;</DIV>
  <DIV>etc.</DIV>
  <DIV>&nbsp;</DIV>
  <DIV>&nbsp;</DIV>
  <DIV>Thanks,<BR>Chris<BR><BR>&gt;&gt;&gt; <A=20
  href=3D"mailto:hace_x@yahoo.com">hace_x@yahoo.com</A> 02/19/02 04:14AM =

  &gt;&gt;&gt;<BR>Hello all,<BR><BR>To get rid of all the log-entries =
created=20
  by<BR>http-viruses, I have created a little windows-program<BR>that =
processes=20
  logfiles and removes those 'dirty'<BR>log-entries that clogup the=20
  xitami-logfile.<BR><BR>You can view all removed lines and kept lines =
in=20
  the<BR>program because all lines are copied in the =
listboxes.<BR><BR>You can=20
  download the program 'logfilter' at:<BR><A=20
  =
href=3D"http://hace.dyndns.org/files/files.html">http://hace.dyndns.org/f=
iles/files.html</A><BR><BR>Please=20
  first read the logfilter.TXT file for further<BR>comments.<BR><BR>If =
you have=20
  questions or suggestions for the program<BR>please sent those to my =
email=20
  address.<BR><BR>Hope this helps people who where searching for =
this<BR>kind of=20
  software and couldn't find it (like=20
  =
myself<BR>;-),<BR><BR>Thanks,<BR>Hace<BR><BR><BR>________________________=
__________________________<BR>Do=20
  You Yahoo!?<BR>Yahoo! Sports - Coverage of the 2002 Olympic =
Games<BR><A=20
  =
href=3D"http://sports.yahoo.com">http://sports.yahoo.com</A><BR><BR>--<BR=
>Xitami=20
  Users Mailing List -- For Xitami support<BR>To unsubscribe: <A=20
  =
href=3D"http://lists.xitami.org/mailman/listinfo/xitami">http://lists.xit=
ami.org/mailman/listinfo/xitami</A><BR></DIV></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_000C_01C1B969.C98DC2A0--