[Xitami] Logfile question

[Brian {Hamilton Kelly}]

In message <NFBBLAFKPCJBBOJPIMLBKEAGDJAA.hieronymus_schweiz@yahoo.de>
   "Hieronymus" writes:

> Hi Mailinglist

This REALLY needs to be added, fast, to the FAQ (I presume that there IS
an FAQ on the website, and that this matter is not already there?)

> 217.162.161.21 - - [19/Jan/2002:16:28:44 +0100] "GET
> /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "" ""
> 
> I have a bunch of error messages in my logfile. What do they mean?

It means that some moron running IIS has allowed his system to be
infected by one of a number of viruses (CodeRed, Nimda, etc) which then
probe the IP address space looking for other idiots also running
unprotected versions of IIS, so that they can infect them also.

It won't hurt Xitami, although if the volume is excessive you might not
like the continuing expansion of your log file.  I would suggest
identifying the ISP(s) of the connecting machine(s) so that you can tell
them, and they in turn can inform their customer.

-- 
Brian {Hamilton Kelly}                                          bhk@dsl.co.uk
    "We have gone from a world of concentrated knowledge and wisdom to one of
    distributed ignorance.  And we know and understand less while being incr-
    easingly capable."              Prof. Peter Cochrane, formerly of BT Labs