[Xitami] what's this?

[Tom Baker]

----- Original Message ----- 
From: "Spider" <spider@rivcom.net>
To: <xitami@lists.xitami.org>
Sent: Monday, June 02, 2003 10:28 PM
Subject: [Xitami] what's this?


> Hi!  New to the list.  Have been running Xitami for some time.....love it.
>
> Questions about the logs   On a few IP's that show up I get blocks of hits
> that look like what is below.
>
> Any ideas as to what this is?  A hacker or?????
>
> Thanks for any info!
>
> Jim Wooddell
>
> here is what I am seeing in my ac logs....
>
> 12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
> /scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
> 12.225.139.174 - - [01/Jun/2003:05:08:35 -0700] "GET
/MSADC/root.exe?/c+dir
> HTTP/1.0" 404 -1 "" ""

Code Red/ Code Red 2 worm is trying to exploit a hole in IIS. So the machine
at 12.225.139.174 is infected, and is trying to infect you. Since you are
not running IIS, this should not be a problem. Everybody gets these. If
you're running Windows, make sure that everything is patched.
The requests will show up as errors in your error log.

Tom