[NTLUG:Discuss] Strange Log entries

[Michael B. Lee]

Just a Windows worm, which is harmless to your linux server. I get the
same thing all the time.

If you had an MS/IIS server, it'd be toast by now.  ;)



On Mon, 12 Nov 2001, Daniel L. Shipman wrote:

> I have been getting some weird entries off of one of my Linux servers running apache. Does any of this look familiar to any of you? I think that it must be an infected Microsoft box trying to find other Microsoft servers to infect.
>
>
> <!--StartFragment-->[Mon Nov 12 04:17:29 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/scripts/root.exe
> [Mon Nov 12 04:17:30 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/MSADC/root.exe
> [Mon Nov 12 04:17:30 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/c/winnt/system32/cmd.exe
> [Mon Nov 12 04:17:30 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/d/winnt/system32/cmd.exe
> [Mon Nov 12 04:17:30 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/scripts/..%5c../winnt/system32/cmd.exe
> [Mon Nov 12 04:17:30 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
> [Mon Nov 12 04:17:30 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
> [Mon Nov 12 04:17:31 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.exe
> [Mon Nov 12 04:17:31 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/scripts/..Á../winnt/system32/cmd.exe
> [Mon Nov 12 04:17:31 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/scripts/..À¯../winnt/system32/cmd.exe
> [Mon Nov 12 04:17:31 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/scripts/..Áo../winnt/system32/cmd.exe
> [Mon Nov 12 04:17:32 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/scripts/..%5c../winnt/system32/cmd.exe
> [Mon Nov 12 04:17:32 2001] [error] [client 64.39.78.13] File does not exist: /home/httpd/html/scripts/..%2f../winnt/system32/cmd.exe
>
>
>
>       Thanks,
>
>
>       Daniel
>       Webmaster for:
>       http://www.srj.net
>       http://www.hometownhospital.com
>       http://www.easyhealthcare.net
>       http://www.ngpa.org
>       http://www.cathedralofhope.com
>       http://www.iusarentals.com
>
>
>
>
>
>       *** CONFIDENTIALITY NOTICE *** Privileged/Confidential Information may be contained in this message and/or its attachments. This message and its attachments are intended only for use by the individual(s) listed as the recipient(s). If you are not one of the intended recipient(s), or responsible for delivery of the message to such person, you are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this message in error, please notify the sender by return email and destroy all copies of the email. Opinions, conclusions and other information in this message that do not relate to official company business shall be understood as neither given nor endorsed by the company.
>
>