That is a worm's footprint (Nimda)
-Andrew
---------- Original Message ----------------------------------
From: Mike Manchester <mchester@yahoo.com>
Reply-To: slug@nks.net
Date: Fri, 26 Oct 2001 07:44:19 -0400
>I'm seeing a lot of these in my webservers access log file. What are
>they?
>216.151.92.2 - - [26/Oct/2001:07:08:23 -0400] "GET
>/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 298 "-"
>"-"
>
>Is someone trying to hack my web server?
>
>Mike M
>
>
>_________________________________________________________
>Do You Yahoo!?
>Get your free @yahoo.com address at http://mail.yahoo.com
>
>
--
cat MCSE | sed s/MCSE/RHCE/g>MCSE && kill -9 `ps -ef | grep MSFT | awk '{print $2}'` && mail -s "Another one bites the dust" bill.gates@microsoft.com
-----BEGIN GEEK CODE BLOCK-----
Version: 3.1
GAT d+@ s+ a- C++++ ULBH++++$ P++++$ L++++$ E--- W+++ N+++ o+++ K- w---$ O M+ V- PS-- PE+ Y- PGP- t+++@ 5- X++ R* tv-- b++++ DI+++ D++ G++ e* h++ r+++ z**
------END GEEK CODE BLOCK------
--
This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 15:49:24 EDT