httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Thomas -Balu- Walter ...@itreff.de>
Subject Re: Am I being probed?
Date Sun, 28 Jul 2002 16:16:36 GMT
+ eric <eric.linux@t-online.de> [28.07.02 18:11]:
> I was going through my Apache access log and found these entries:
> 
> 217.228.40.62 - - [27/Jul/2002:19:16:05 +0200] "GET /scripts/root.exe?/c+dir 
> HTTP/1.0" 404 787

Those look like probes from hosts that were infected by a worm (like
Nimda). Have a look at
        http://www.securityspace.com/smysecure/w32_nmda_amm.html
or search for parts of the log entries at google to find a lot more.

You might even want to inform the admins of the boxes that were infected
- like the one at 217.228.40.62

     Balu

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message