GIDForums  

Go Back   GIDForums > Web Hosting Forums > Apache Web Server Forum
User Name
Password
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

 
 
Thread Tools Search this Thread Rate Thread
  #1  
Old 19-Dec-2003, 17:32
moothecow moothecow is offline
New Member
 
Join Date: Dec 2003
Posts: 1
moothecow is on a distinguished road
Exclamation

Urgernt: Extremely queer Apache access log


I've switched ISPs, computers, and such--even reinstalled Windows, going from 2k to XP.

I'm running the Windows version of Apache, the latest, on Windows XP Home edition (I believe it's the Home edition).

I've got numerous problems with my access log. The oldest two are: wierd access attempts, and gibberish. Here's an example of a wierd access attempt:

24.42.139.93 - - [14/Dec/2003:14:13:48 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306

Here's an example of gibberish:

MHe<O-ˆ¦á„ô£“Òyk„ò¦?Ôˆa
eªK:•Î3£¬»'Cªë$‚‹öºa?Þd¨æôÐBbgmAèdÒx—jÖSiãVN ü\&

Note that more then 95% of my Access Log is made up of stuff like this.

Recently, I have two new problems--java code I've made and hosted appearing in my log, and PDB molecules.

PDB Example:
ATOM 477 N VAL 47 48.516 -7.484 35.561
ATOM 478 CA VAL 47 48.590 -8.919 35.777

Note that some of these molecules run as high as 1000. They don't start at 1, though.

Argh, I've even got HTML in here (</Text></Message><Message Date="08/12/2003" Time="3:53:01 PM" DateTime="2003-12-08T20:53:01.464Z" SessionID="187">)

...I strongly suspect my data files are turning up in the access log. Some in binary form (gibberish), some as HTML (I think I know where the files are from), and somehow, some PDB stuff I've never really seen before.

Any ideas what's going on here?
  #2  
Old 20-Dec-2003, 02:45
Allowee's Avatar
Allowee Allowee is offline
Regular Member
 
Join Date: May 2003
Location: The Netherlands
Posts: 339
Allowee has a spectacular aura about
Quote:
Originally Posted by moothecow
24.42.139.93 - - [14/Dec/2003:14:13:48 -0500] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306
I only know what the weird lines in your access log are..

That will be people trying top hack you.
my logs are full wih that stuff.
I think there has been some exploit in the PWS or IIS because when i use apache the error you get will be 404, Not Found

if you have up-to-date versions of webservers you will be secure and you can just ignore those messages.

btw, AFAIR all the requests like that came from address at my own ISP.
it could be that ISP's are checking for insecure systems..
__________________
Pastebin
PHP Documentation Site
Allowee's Blog http://allowee.net
 
 

Recent GIDBlogInstall Adobe Flash - Without Administrator Rights by LocalTech

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Network Sites: GIDNetwork · GIDWebHosts · GIDSearch · Learning Journal by J de Silva, The

All times are GMT -6. The time now is 06:37.


vBulletin, Copyright © 2000 - 2010, Jelsoft Enterprises Ltd.