Re: [SLUG] What does this mean

From: Glenn Meyer (me@glennmeyer.com)
Date: Fri Oct 26 2001 - 08:31:26 EDT

Next message: Justin Keyes: "Re: [SLUG] First of a Dozen Questions -Solved"
Previous message: Andrew Wyatt: "RE: [SLUG] What does this mean"
In reply to: Mike Manchester: "[SLUG] What does this mean"
Next in thread: Bill: "Re: [SLUG] What does this mean & how can it be handled?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

I believe that is a Nimda infected MS-IIS server looking for other vulnerable
boxes.

On Friday 26 October 2001 07:44 am, you wrote:
> I'm seeing a lot of these in my webservers access log file. What are
> they?
> 216.151.92.2 - - [26/Oct/2001:07:08:23 -0400] "GET
> /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 298 "-"
> "-"
>
> Is someone trying to hack my web server?
>
> Mike M
>
>
> _________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.com address at http://mail.yahoo.com

Next message: Justin Keyes: "Re: [SLUG] First of a Dozen Questions -Solved"
Previous message: Andrew Wyatt: "RE: [SLUG] What does this mean"
In reply to: Mike Manchester: "[SLUG] What does this mean"
Next in thread: Bill: "Re: [SLUG] What does this mean & how can it be handled?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 15:49:28 EDT