httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "J.D. Bronson" <li...@xpec.com>
Subject Re: I'm being scanned... What do I do?
Date Sun, 30 Dec 2001 14:02:13 GMT
Looks like the NIMDA worm at work :)



At 07:49 AM 12/30/2001, you wrote:
>My home network keeps getting scanned by some network trying to get a WinNT
>command line.
>
>This log snippet below is from my /etc/httpd/logs/error_log file (see
>below). There are 12,614 occurances of this type scan. I don't have a static
>IP. I only have one file in my /var/www/html/domains directory... the
>default index.html file. I don't have a scripts  folder.
>
>Is there anything I can do to trace back to the owner of that computer and
>let them know that A) they have a virus or B) ask them to stop filing up my
>log.
>
>Thanks
>
>-Allen
>
>
>[Tue Dec  4 17:06:12 2001] [error] [client 64.105.78.125] File does not
>exist: /var/www/html/domains/scripts/..Á../winnt/system32/cmd.exe
>[Tue Dec  4 17:06:12 2001] [error] [client 64.105.78.125] File does not
>exist: /var/www/html/domains/scripts/..À¯../winnt/system32/cmd.exe
>[Tue Dec  4 17:06:12 2001] [error] [client 64.105.78.125] File does not
>exist: /var/www/html/domains/scripts/..Á../winnt/system32/cmd.exe
>[Tue Dec  4 17:06:13 2001] [error] [client 64.105.78.125] File does not
>exist: /var/www/html/domains/scripts/..%5c../winnt/system32/cmd.exe
>[Tue Dec  4 17:06:13 2001] [error] [client 64.105.78.125] File does not
>exist: /var/www/html/domains/scripts/..%2f../winnt/system32/cmd.exe
>[Tue Dec  4 17:28:50 2001] [error] [client 64.105.127.100] File does not
>exist: /var/www/html/domains/c/winnt/system32/cmd.exe
>
>
>
>---------------------------------------------------------------------
>The official User-To-User support forum of the Apache HTTP Server Project.
>See <URL:http://httpd.apache.org/userslist.html> for more info.
>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>For additional commands, e-mail: users-help@httpd.apache.org


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message