Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
access my webserver using several weird pieces of crap. like :
i'm using apache webserver on a win 2k system3394 62.172.162.92 /scripts/root.exe?/c+dir May 21, 2002, 10:17 am
3395 62.172.162.92 /MSADC/root.exe?/c+dir May 21, 2002, 10:17 am3091 62.131.72.128 /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir May 20, 2002, 9:36 pm
3092 62.131.72.128 /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir May 20, 2002, 9:36 pmnow i suspect one of em of having nimda .. since when i visit the ip adress at the http port my virus scanner picks up a nice nimbda
now how do i contact the admin of this webserver ?
i mean i tried dns lookups and i didn't get a thing .. i want to warn these people ...i already put them in my deny from list :) but still ...
help me
Please do not post the url's to infected servers. A curious unsuspecting user might type it in and become infected.
Best thing to do is block it and ignore it. the fact that they are still infected by nimbda leads me to beleive they dont have an admin or they dont care.
0 
first of all they are not url's :)
they are logs.
the first part is the log id line
then comes the ip adress
then comes the path they tried to access.
then the date / timei scanned my logs and came up with a veeeery long list of people ....
turns out they were using an iis scanner(or so says my classmate)
i added all those ip's to my deny from
list :)
so they can't get on my webserver anymore.i also reported them to my isp. and hopefully they will report it to their isp
0
Don't waste your time with that and simply ignore them. If the involved admin is too lazy or stupid to secure their system, he will not even read your warning anyway.
Otherwise, trying to trace and notice all thousands infected network will become a full-time job!!!
0
These are automated scans for known vulnerabilities in IIS. Most likely the computers doing the scanning are infected with nimda or a something similar, without the owners' knowledge. As Danny Larouche said, trying to trace or report all of these rogue boxes would be a full time job, and probably wouldn't be worth your time. A better idea would be to make sure your own box is as secure as possible.
Since you're running Apache, the vulnerabilities being scanned for don't apply to you. You should still make sure your OS is patched though. Hfnetchk can scan your system and tell you what hotfixes you're missing.
Anyway, if you still want to try and contact the owners of the boxes that are scanning you, whois can be a useful tool.
Response Number 5 Reply:
hmm....the last few lines of my post got truncated. oh well. anyway, try
Response Number 6 Response Number 7 Reply:
[a href="http://www.samspade.org>www.samspade.org[/a]
The " after org. This is what killed the rest of your post.
[a href="http://www.samspade.org"]www.samspade.org[/a]
Sponsored Link
Post LockedThis post is quite old and has been locked from receiving new replies. Please create a new posting instead.
Go to Security and Virus Forum Home
Sponsored links
Ads by Google
Results for: How do i report people who try to ....How do I.....?Summary: I have installed the EZ Firewall that came with the Feb. 2004 Security CD from Microsoft. I installed it just to see how it worked, and to see if I should purchase the full version. I got an alert ...
www.computing.net/answers/security/how-do-i/11225.html
How can I identify dll that tries tSummary: Hi guys I got this problem when I probably downloaded and installed some software.. Whenever a few programs - not all, only a few like IE, Outlook Express, and - very unfortunately - antivirus updater...
www.computing.net/answers/security/how-can-i-identify-dll-that-tries-t/12529.html
How do I trace a server?Summary: When I booted up tonight and dialed in to my ISP, Sygate firewall told ne that WIn32 kernel core component was trying to connect to.. a certain location, as in ###.#.#.#. This is not the address of m...
www.computing.net/answers/security/how-do-i-trace-a-server/4093.html
