[Xitami] Logfile question

[eric]

1/19/02 11:51:37 AM, bhk@dsl.co.uk (Brian {Hamilton Kelly}) wrote:
	I just went over my logfiles to see what there was for hacks and found the 
same thing. However, to go further, it appears to be a script that runs at a particular time 
from particular servers and looks for the same things, suchas, msadc, cmd.exe, 
/scripts/root and so on.

	I figure I don't have a problem as long as the 404 message comes up in the 
logfiles...if it doesn't I'll worry <LOL>.

	BTW, this isn't in the FAQ and if anyone wants to, check out the Honeypot 
Project for some good information. http://project.honeynet.org

	Thanks for the information.
             
                                                Eric

>In message <NFBBLAFKPCJBBOJPIMLBKEAGDJAA.hieronymus_schweiz@yahoo.de>
>   "Hieronymus" writes:
>
>> Hi Mailinglist
>
>This REALLY needs to be added, fast, to the FAQ (I presume that there IS
>an FAQ on the website, and that this matter is not already there?)
>
>> 217.162.161.21 - - [19/Jan/2002:16:28:44 +0100] "GET
>> /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "" ""
>> 
>> I have a bunch of error messages in my logfile. What do they mean?
>
>It means that some moron running IIS has allowed his system to be
>infected by one of a number of viruses (CodeRed, Nimda, etc) which then
>probe the IP address space looking for other idiots also running
>unprotected versions of IIS, so that they can infect them also.
>
>It won't hurt Xitami, although if the volume is excessive you might not
>like the continuing expansion of your log file.  I would suggest
>identifying the ISP(s) of the connecting machine(s) so that you can tell
>them, and they in turn can inform their customer.
>
>-- 
>Brian {Hamilton Kelly}                                          bhk@dsl.co.uk
>    "We have gone from a world of concentrated knowledge and wisdom to one of
>    distributed ignorance.  And we know and understand less while being incr-
>    easingly capable."              Prof. Peter Cochrane, formerly of BT Labs
>
>--
>Xitami Users Mailing List -- For Xitami support
>To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>




_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com